CVE-2022-41404: 
Java vulnerability analysis and mitigation

An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. The vulnerability was discovered in October 2022 and affects the ini4j library, which is used for handling Windows ini file format (NVD, Debian LTS).

The vulnerability exists in the recursive calls from the BasicProfileSection.fetch and BasicProfile.resolve methods, where recursive loops can occur without any limitation when processing manipulated ini files. The issue has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, SourceForge Bug).

When exploited, this vulnerability can lead to a Denial of Service condition through infinite recursion when processing specially crafted ini files. The attack affects the availability of applications using the vulnerable ini4j library (NVD).

Users are recommended to upgrade to ini4j version 0.5.4 or later which addresses this vulnerability. For Debian 10 (buster) users, the fix is available in version 0.5.4-1~deb10u1 (Debian LTS).