PT-2022-23121 · Unknown · Deeplearning4J

Draco1725 · Published 2022-11-10 · Updated 2022-11-15 · CVE-2022-36022

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Deeplearning4J versions through 1.0.0-M2.1

Description The issue affects users of older NLP examples that reference an old S3 bucket. The problem arises from the use of some unclaimed S3 buckets in tests and examples. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions through 1.0.0-M2.1, upgrade to snapshots as a fix is planned to be published in a later release. As a temporary workaround, download a word2vec google news vector from a new source using git lfs.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-344

CWE-330

Related Identifiers

CVE-2022-36022

GHSA-RC39-G977-687W

Affected Products

Deeplearning4J

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36022.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-36022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36022 · Security Note
• https://osv.dev/vulnerability/GHSA-rc39-g977-687w · Vendor Advisory
• https://github.com/eclipse/deeplearning4j/security/advisories/GHSA-rc39-g977-687w · Note
• https://github.com/deeplearning4j/deeplearning4j/security/advisories/GHSA-rc39-g977-687w · Note
• https://github.com/deeplearning4j/deeplearning4j · Note
• https://github.com/mmihaltz/word2vec-GoogleNews-vectors · Note
• https://t.me/cvenotify/37802 · Telegram Post