CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21634 – Ion Java StackOverflow vulnerability
https://notcve.org/view.php?id=CVE-2024-21634
Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with. • https://github.com/amazon-ion/ion-java/security/advisories/GHSA-264p-99wq-f4j6 https://access.redhat.com/security/cve/CVE-2024-21634 https://bugzilla.redhat.com/show_bug.cgi?id=2304311 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 3.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30857 – @aedart/support possibly vulnerable to prototype pollution in metadata record, when using meta decorator
https://notcve.org/view.php?id=CVE-2023-30857
@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`. • https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291 https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •