PT-2022-27618 · Atlassian+3 · Bitbucket Server+5

Bingdian-So · Published 2022-12-13 · Updated 2025-04-22 · CVE-2022-45685

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jettison versions prior to 1.5.2 Bitbucket Data Center and Server versions 7.17.0 through 8.12.0

Description A stack overflow in Jettison allows attackers to cause a Denial of Service (DoS) via crafted JSON data. This issue has a high impact on availability, with no impact on confidentiality and integrity, and requires no user interaction.

Recommendations For Jettison, upgrade to version 1.5.2 or later. For Bitbucket Data Center and Server 7.21, upgrade to a release greater than or equal to 7.21.15. For Bitbucket Data Center and Server 8.9, upgrade to a release greater than or equal to 8.9.4. For Bitbucket Data Center and Server 8.10, upgrade to a release greater than or equal to 8.10.4. For Bitbucket Data Center and Server 8.11, upgrade to a release greater than or equal to 8.11.3. For Bitbucket Data Center and Server 8.12, upgrade to a release greater than or equal to 8.12.1.

Exploit

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-45685

DLA-3259-1

DSA-5312-1

GHSA-7RF3-MQPX-H7XG

OESA-2023-1914

OESA-2023-1965

OPENSUSE-SU-2024:12567-1

USN-6177-1

Affected Products

Astra Linux

Bitbucket

Bitbucket Server

Jira

Linuxmint

Ubuntu

References · 35

• 🔥 https://github.com/jettison-json/jettison/issues/54 · Exploit
• https://cve.org/CVERecord?id=CVE-2022-45685 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1914 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45685 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3259-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12567-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45693 · Security Note
• https://ubuntu.com/security/notices/USN-6177-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45685 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40150 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6177-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45685 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1965 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-45685 · Vendor Advisory