{"action":"Upgrade org.apache.johnzon:johnzon-mapper to 1.2.21 or later.","affected":[{"fixed":"1.2.21","introduced":"0"}],"component":"org.apache.johnzon:johnzon-mapper","cve_ids":["CVE-2023-33008"],"ecosystem":"Maven","epss":0.01442,"exploited":false,"fixed_versions":["1.2.21"],"ghsa_id":"GHSA-crqg-jrpj-fc84","id":"tcs_01M5N8T8HBH3FSJG59VXDXVZ8T","modified_at":"2024-02-16T08:00:08.359623Z","published_at":"2023-07-07T12:30:22Z","references":["https://osv.dev/vulnerability/GHSA-crqg-jrpj-fc84","https://nvd.nist.gov/vuln/detail/CVE-2023-33008","https://github.com/apache/johnzon/commit/34ad9a6b296ae7b4667c3cf0037998e451499ea4","https://github.com/apache/johnzon","https://issues.apache.org/jira/browse/JOHNZON-397","https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-crqg-jrpj-fc84","url":"https://osv.dev/vulnerability/GHSA-crqg-jrpj-fc84"}],"summary":"Apache Johnzon Deserialization of Untrusted Data vulnerability"}