fix: bump org.json:json to 20231013 (CVE-2023-5072) - #34

Automated dependency fix — CVE-2023-5072

Package: org.json:json 20090211 → 20231013
Severity: high
Lane: advised-bump

Assessment

• Exploitability: Remote attackers can trigger denial-of-service via crafted JSON input parsed by the vulnerable library; low complexity and no auth required, though EPSS is modest (~1.4%) and not in KEV.
• Business impact: Application-level denial of service (OutOfMemoryError) affecting availability of any endpoint processing untrusted JSON via org.json.
• Confidence: 0.95
• Rationale: Direct, reachable dependency on a very old org.json version (20090211) with a clear fixed release (20231013), making this a high-confidence, straightforward version-bump remediation.

Advisory

• Breaking-change risk: low
• Bump org.json:json from 20090211 to 20231013 to fix CVE-2023-5072 (parser confusion leading to OOM DoS). This is a direct dependency upgrade to the scanner's fixed version; the org.json API has remained stable, so risk is low, but note the installed version is very old so a quick smoke test of JSON parsing paths is advised.

Validation

• Patched branch installs, but the test suite fails.

Opened by the vulnerability management platform after human approval.