PT-2022-27413 · Apache+1 · Apache Jena Tdb 2+2

Crilwa + 1 · Published 2022-11-14 · Updated 2024-08-03 · CVE-2022-45136

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Jena SDB versions 3.17.0 and earlier

Description The issue allows for a JDBC Deserialisation attack if the attacker can control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver is known to be vulnerable to this class of attack. As a result, an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020.

Recommendations To resolve the issue, users should migrate to alternative options, such as Apache Jena TDB 2. As a temporary workaround, consider restricting access to the vulnerable JDBC URL until a patch is available. Avoid using the mySQL JDBC driver in Apache Jena SDB until the issue is resolved. Migrate to Apache Jena TDB 2 to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-45136

GHSA-G2QW-6VRR-V6PQ

Affected Products

Apache Jena Sdb

Apache Jena Tdb 2

Mysql Jdbc Driver

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45136 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45136 · Vendor Advisory
• https://lists.apache.org/thread/mc77cdl5stgjtjoldk467gdf756qjt31 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45136 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-45136 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45136 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-45136 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g2qw-6vrr-v6pq · Vendor Advisory
• https://github.com/apache/jena · Note
• https://t.me/cvenotify/37617 · Telegram Post
• https://t.me/cvenotify/88777 · Telegram Post
• https://openwall.com/lists/oss-security/2022/11/14/5 · Note
• http://openwall.com/lists/oss-security/2022/11/14/5 · Note