-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a StackOverflowError (Denial of Service) in ion-java when deserializing crafted Ion data and then invoking certain IonValue methods. The NVD entry CVE-2024-21634 lists CWE-674 (Uncontrolled Recursion) and CWE-770.
Two primary commits between the vulnerable version range (<1.10.5) and the patched version (1.10.5) address issues in IonValue processing that could lead to uncontrolled recursion:
Commit 0a4b60efc77d9913b1c1ec5d5ce8c7f3ae0355cc fixes a bug in com.amazon.ion.impl.lite.IonValueLite.hashTypeAnnotations. This method is a component of com.amazon.ion.impl.lite.IonValueLite.hashCode(). The hashCode() method is recursive for Ion container types. A flaw in hashTypeAnnotations could contribute to the hashCode() recursion becoming uncontrolled on crafted data, leading to a StackOverflow. Thus, com.amazon.ion.impl.lite.IonValueLite.hashCode() is identified as a vulnerable function.
Commit 250258a2cd3f1ba39f9f51bff411edebfa2a42d5 changes the behavior of com.amazon.ion.impl.lite.IonValueLite.toString(). It modifies the default writer used by toString() to allow invalid Symbol IDs (SIDs). The toString() method relies on the recursive writeTo(IonWriter) method. Previously, encountering certain invalid SID configurations during the writeTo process (as called by toString) could trigger uncontrolled recursion. The patch mitigates this by making the writer more lenient. Thus, com.amazon.ion.impl.lite.IonValueLite.toString() is identified as another vulnerable function.
Both hashCode() and toString() are common IonValue methods that would be invoked after deserialization, fitting the vulnerability description. The patches address underlying issues that could cause these recursive methods to exhaust the stack.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.amazon.ion:ion-java | maven | < 1.10.5 | 1.10.5 |
| software.amazon.ion:ion-java | maven | < 1.10.5 |
Ongoing coverage of React2Shell