chore(deps): update dependency newtonsoft.json to 13.0.2 [security] - abandoned

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Newtonsoft.Json (source)	13.0.1 -> 13.0.2

GitHub Vulnerability Alerts

CVE-2024-21907

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS).

The serialization and deserialization path have different properties regarding the issue.

Deserializing methods (like JsonConvert.DeserializeObject) will process the input that results in burning the CPU, allocating memory, and consuming a thread of execution. Quite high nesting level (>10kk, or 9.5MB of {a:{a:{... input) is needed to achieve the latency over 10 seconds, depending on the hardware.

Serializing methods (like JsonConvert.Serialize or JObject.ToString) will throw StackOverFlow exception with the nesting level of around 20k.

To mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set MaxDepth parameter in the JsonSerializerSettings. This can be done globally with the following statement. After that the parsing of the nested input will fail fast with Newtonsoft.Json.JsonReaderException:

JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 };

Repro code:

//Create a string representation of an highly nested object (JSON serialized)
int nRep = 25000;
string json = string.Concat(Enumerable.Repeat("{a:", nRep)) + "1" +
 string.Concat(Enumerable.Repeat("}", nRep));

//Parse this object (leads to high CPU/RAM consumption)
var parsedJson = JsonConvert.DeserializeObject(json);

// Methods below all throw stack overflow with nRep around 20k and higher
// string a = parsedJson.ToString();
// string b = JsonConvert.SerializeObject(parsedJson);

Additional affected product and version information

The original statement about the problem only affecting IIS applications is misleading. Any application is affected, however the IIS has a behavior that stops restarting the instance after some time resulting in a harder-to-fix DoS.**

---

Release Notes

JamesNK/Newtonsoft.Json (Newtonsoft.Json)

v13.0.2

Compare Source

• New feature - Add support for DateOnly and TimeOnly
• New feature - Add UnixDateTimeConverter.AllowPreEpoch property
• New feature - Add copy constructor to JsonSerializerSettings
• New feature - Add JsonCloneSettings with property to disable copying annotations
• Change - Add nullable annotation to JToken.ToObject(Type, JsonSerializer)
• Change - Reduced allocations by reusing boxed values
• Fix - Fixed MaxDepth when used with ToObject inside of a JsonConverter
• Fix - Fixed deserializing mismatched JToken types in properties
• Fix - Fixed merging enumerable content and validate content
• Fix - Fixed using $type with arrays of more than two dimensions
• Fix - Fixed rare race condition in name table when deserializing on device with ARM processors
• Fix - Fixed deserializing via constructor with ignored base type properties
• Fix - Fixed MaxDepth not being used with ISerializable deserialization

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.