Haven't tested it thoroughly yet, but our main issue is that 20231013 seems to be included in the vulnerable versions in our Nexus Lifecycle tool:

Not sure if it's an administration error, or if they feel that 20231013 doesn't actually fix the vulnerability.

I'll try to contact SonaType to see whats up.

Update: opened support ticket:

https://nvd.nist.gov/vuln/detail/CVE-2023-5072 is marked as: "JSON-Java versions up to and including 20230618"
The developers assert that is has been resolved in version 20231013 #789

But Nexus IQ/Lifecycle says:
Recommendation
There is no non-vulnerable upgrade path for this component/package. We recommend investigating alternative > components or a potential mitigating control.
Version Affected
[20070829,20231013]

Any reason why SonaType would mark this specific version as vulnerable?

Update 2: apparently there's a dedicated place to submit corrections. So I've done so.
https://ossindex.sonatype.org/component/pkg:maven/org.json/json@20231013 will hopefully no longer be marked as vulnerable soon.

CVE-2023-5072 - Denial of Service in JSON-Java versions up to and including 20230618. #789

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions