CVE-2022-45688 in org.json/json

[melloware]

See: stleary/JSON-java#708

Reported: jeremylong/DependencyCheck#5401

Because PF shades org.json.

[melloware]

cc @blutorange

[melloware]

OK PF is NOT vulnerable to this and should not be reported. When we shade the JAR it does not include the XML classes. Here is the PF 12.0.0 JAR in Maven Central

Here is the contents of the whole org.json JAR but we are exlcuding the vulnerable XML classes.

[melloware]

Does anyone agree with my assessment?

[blutorange]

The CVE explicitly only mentions XML.toJSONObject (and only that method). In principle,that method could still call a method from another non-excluded class that contains the vulnerable logic. But checking the source code and the proposed commit that fixes the vulnerability (https://github.com/stleary/JSON-java/pull/720/files), the logic that does the parsing is also in the XML classes. So I would tend to agree that PrimeFaces is not affected.

[melloware]

cc @cnsgithub

[AndreasIgelCC]

@melloware, @blutorange: same result for Primefaces version 8.0.22?

[melloware]

Yes for this specific CVE I am confident it's not vulnerable. However there is chatter on the JSON project they may open a new CVE similar but not the same. I am waiting to analyze that.

[AndreasIgelCC]

@melloware could you please release that for 8.0.X too?

[tandraschko]

@AndreasIgelCC please see: https://github.com/primefaces/primefaces#community--elite--pro

[svenhaag]

@AndreasIgelCC please see: https://github.com/primefaces/primefaces#community--elite--pro

Hi guys, when can the 8.0.24 release be expected?
Also see my related question here: See. https://github.com/orgs/primefaces/discussions/85
@mertsincan

[mertsincan]

Thanks @melloware ;)