GHSA-c4pm-63cg-9j7h
Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | nl.basjes.parse.useragent:yauaa | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-beam | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-beam-sql | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-drill | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-elasticsearch | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-elasticsearch-8 | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-flink | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-flink-table | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-hive | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-logparser | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-snowflake | >= 7.0.0, < 7.9.0 | 7.9.0 |
| Maven | nl.basjes.parse.useragent:yauaa-trino | >= 7.0.0, < 7.9.0 | 7.9.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. Applications that do not use this feature are not affected.
### Patches
Upgrade to 7.9.0
### Workarounds
Catch and discard any exceptions from Yauaa.
References
External links from the advisory. They lead to third-party sites.