critical9.8
CVE-2023-39020
Code injection in stanford-parser
Impact
stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | edu.stanford.nlp:stanford-parser | < 4.5.5 | 4.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Stanford | Stanford Parser | before 4.5.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/LetianYuan/My-CVE-Public-References/tree/main/edu_stanford_nlp_stanford-parser
- https://github.com/advisories/GHSA-353m-jh2m-72v4
- https://nvd.nist.gov/vuln/detail/CVE-2023-39020
- https://github.com/stanfordnlp/CoreNLP/commit/897231bed0efb24574c80c875c0b5f2225c145bc