{"id":"GHSA-c4pm-63cg-9j7h","summary":"Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List","details":"### Impact\nApplications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. Applications that do not use this feature are not affected.\n\n### Patches\nUpgrade to 7.9.0\n\n### Workarounds\nCatch and discard any exceptions from Yauaa.\n","aliases":["CVE-2022-23496"],"modified":"2025-01-17T17:24:25.271517Z","published":"2022-12-08T15:52:54Z","database_specific":{"cwe_ids":["CWE-755"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-12-08T15:52:54Z","nvd_published_at":"2022-12-08T22:15:00Z"},"references":[{"type":"WEB","url":"https://github.com/nielsbasjes/yauaa/security/advisories/GHSA-c4pm-63cg-9j7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23496"},{"type":"WEB","url":"https://github.com/nielsbasjes/yauaa/commit/3017a866e2cff0d308f264b66fde4fa79e3beb9e"},{"type":"PACKAGE","url":"https://github.com/nielsbasjes/yauaa"}],"affected":[{"package":{"name":"nl.basjes.parse.useragent:yauaa","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-beam","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-beam"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-beam-sql","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-beam-sql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-drill","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-drill"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-elasticsearch","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-elasticsearch"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-elasticsearch-8","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-elasticsearch-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-flink","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-flink"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-flink-table","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-flink-table"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-hive","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-hive"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-logparser","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-logparser"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-snowflake","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-snowflake"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}},{"package":{"name":"nl.basjes.parse.useragent:yauaa-trino","ecosystem":"Maven","purl":"pkg:maven/nl.basjes.parse.useragent/yauaa-trino"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.9.0"}]}],"versions":["7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-c4pm-63cg-9j7h/GHSA-c4pm-63cg-9j7h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}]}