An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2…
Priority LOW 38CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02886 86th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial net.minidev:json-smart (Maven): 1.3.2, 2.4.1, 2.3.1net.minidev:json-smart-mini (Maven): 1.3.2Red Hat: 5 advisoriesRed Hat: 5 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | net.minidev:json-smart (Maven) | before 1.3.2 | 1.3.2 | Patch available | GHSA-v528-7hrm-frqp |
| — | net.minidev:json-smart (Maven) | 2.4.0 to before 2.4.1 | 2.4.1 | Patch available | GHSA-v528-7hrm-frqp |
| — | net.minidev:json-smart-mini (Maven) | before 1.3.2 | 1.3.2 | Patch available | GHSA-v528-7hrm-frqp |
| — | net.minidev:json-smart (Maven) | 2.0.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-v528-7hrm-frqp |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- net.minidev:json-smart (Maven) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-v528-7hrm-frqp
- net.minidev:json-smart (Maven) Vendor— Affected 2.4.0 to before 2.4.1 Fixed in 2.4.1 Patch available GHSA-v528-7hrm-frqp
- net.minidev:json-smart-mini (Maven) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-v528-7hrm-frqp
- net.minidev:json-smart (Maven) Vendor— Affected 2.0.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-v528-7hrm-frqp
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:json-smart_project:json-smart-v1:*:*:*:*:*:*:*:* | before 1.3.2 | Vulnerable | Json-smart Project |
| cpe:2.3:a:json-smart_project:json-smart-v2:*:*:*:*:*:*:*:* | before 2.3.1; 2.4 to before 2.4.1 | Vulnerable | Json-smart Project |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* | before 2.12.42 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* | 4.4.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* | 4.4.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* | 4.4.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:json-smart_project:json-smart-v1:*:*:*:*:*:*:*:* Versions before 1.3.2 Vulnerable ·Json-smart Project
- cpe:2.3:a:json-smart_project:json-smart-v2:*:*:*:*:*:*:*:* Versions before 2.3.1; 2.4 to before 2.4.1 Vulnerable ·Json-smart Project
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* Versions before 2.12.42 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* Versions 4.4.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-v528-7hrm-frqp net.minidev:json-smart (Maven) Fixed in 1.3.2 Advisory →
- Fix · GHSA-v528-7hrm-frqp net.minidev:json-smart (Maven) Fixed in 2.4.1 Advisory →
- Fix · GHSA-v528-7hrm-frqp net.minidev:json-smart-mini (Maven) Fixed in 1.3.2 Advisory →
- Fix · GHSA-v528-7hrm-frqp net.minidev:json-smart (Maven) Fixed in 2.3.1 Advisory →
Red Hat 5 advisories
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:4918 Released 2021-12-02 · Red Hat rating ModerateRed Hat Integration Camel-K 1.6 release and security update
- Red Hat Integration
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
Show 2 more Red Hat advisories
- RHSA-2021:3225 Released 2021-08-19 · Red Hat rating ModerateRed Hat AMQ Streams 1.8.0 release and security update
- Red Hat AMQ Streams 1.8.0
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat AMQ Streams 1.8.0 | Fixed | RHSA-2021:3225 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat Integration | Fixed | RHSA-2021:4918 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
Not affected: 3 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat Integration Camel Quarkus 1
- Red Hat OpenShift Container Platform 3.11
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27568
- 2026-10-03 Alias added: GHSA-v528-7hrm-frqp
- 2026-10-08 CISA SSVC decision points changed
References
Exploit 2
Patch 3
Other 10
- [druid-commits] 20210712 [GitHub] [druid] zachjsh opened a new pull request #11438: Suppress CVE-2021-27568 from json-smart 2.3 dependency
- [druid-commits] 20210712 [druid] branch master updated: Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438)
- [druid-commits] 20210712 [GitHub] [druid] zachjsh merged pull request #11438: Suppress CVE-2021-27568 from json-smart 2.3 dependency
- https://github.com/netplex/json-smart-v2/issues/62
- https://github.com/netplex/json-smart-v2/pull/72
- https://github.com/netplex/json-smart-v1/commit/768db58ee0e3e344fcdb574b7629765308a1d0af
- https://github.com/netplex/json-smart-v2
- https://lists.apache.org/thread.html/rb6287f5aa628c8d9af52b5401ec6cc51b6fc28ab20d318943453e396@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/re237267da268c690df5e1c6ea6a38a7fc11617725e8049490f58a6fa@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rf70210b4d63191c0bfb2a0d5745e104484e71703bf5ad9cb01c980c6@%3Ccommits.druid.apache.org%3E
Sources
- CVE-2021-27568 · CVE Program
- CVE-2021-27568 · NVD
- FIRST EPSS
- GHSA-v528-7hrm-frqp · GitHub Advisory Database · CC BY 4.0
- CVE-2021-27568 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences