PT-2022-25247 · Jettison+4 · Jettison+4

Published 2022-09-16 · Updated 2024-06-15 · CVE-2022-40150

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jettison (affected versions not specified)

Description The issue allows an attacker to cause a Denial of Service (DOS) by supplying content that causes the parser to crash due to an Out of memory error when parsing untrusted XML or JSON data. This can support a denial of service attack if the parser is running on user-supplied input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Uncontrolled Recursion

Resource Exhaustion

Weakness Enumeration

CWE-674

CWE-400

Related Identifiers

CVE-2022-40150

DLA-3259-1

DSA-5312-1

GHSA-X27M-9W8J-5VCW

OESA-2023-1914

OESA-2023-1965

OPENSUSE-SU-2024:12388-1

RHSA-2023:0552

RHSA-2023:0553

RHSA-2023:0554

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

RHSA-2023:3610

RHSA-2023:3663

RHSA-2025:4437

USN-6177-1

Affected Products

Astra Linux

Jettison

Jira

Linuxmint

Ubuntu

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2022-45693 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1914 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-40150 · Vendor Advisory
• https://debian.org/security/2023/dsa-5312 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40150 · Security Note
• https://ubuntu.com/security/notices/USN-6177-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6177-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40150 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-40150 · Security Note
• https://ubuntu.com/security/CVE-2022-40150 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40149 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12388-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40149 · Security Note
• https://ubuntu.com/security/CVE-2022-45693 · Vendor Advisory