CVE-2022-42003
Aliases:GHSA-jjjh-jjxp-wpffDEBIAN-CVE-2022-42003CGA-2xmf-6hgm-7hg3CGA-357h-g2gf-w23pCGA-3jqx-572h-28gpCGA-43fv-xv94-gfpxCGA-554j-rjrw-h3m9CGA-86gf-8h35-cfc4CGA-8q6r-5mf3-x438CGA-963m-qpc3-24p7CGA-9xrv-cxcc-v73xCGA-c39g-fqvq-ffqwCGA-cgc7-w87m-57x8CGA-h5cp-9r37-r28mCGA-h788-38f5-66p7CGA-j4g4-2h32-2qghCGA-jp24-66x7-mqv7CGA-m9mf-8rrg-m842CGA-m9qc-r8rf-7qhgCGA-mj76-c97m-xrrgCGA-p77h-j953-wx3wCGA-p793-7q85-wpw5CGA-2536-ff2x-7c2pCGA-2g4c-rp4q-jf7fCGA-2v6h-82ww-94vrCGA-2x7w-q7g2-f37vCGA-32j6-5g3c-grrhCGA-39jh-4m5c-6vmrCGA-3j7j-5w75-9p42CGA-3jrv-5x8q-3cvjCGA-44v2-2x96-6fmjCGA-49mx-rp8x-gg78CGA-4gx8-2824-j8x4CGA-4m69-7h39-qm4qCGA-5326-jc65-9q2mCGA-55hr-vf6r-w75wCGA-5783-3ghr-336pCGA-62jx-jw65-x328CGA-634w-xw77-rhfgCGA-67gv-8323-hxpgCGA-6j75-wj84-h3g7CGA-6r5m-42jf-mgmfCGA-6xqh-5rwj-hrpwCGA-76p9-jpc9-5rp8CGA-7c48-rc7g-cchpCGA-7rm5-j288-2mhfCGA-85hq-p52f-pfx7CGA-886q-9v3q-9xmcCGA-8pg9-pw4m-xf2pCGA-96hg-v244-7qcfCGA-9724-pj48-cjm8CGA-9mrf-339j-8c27CGA-c7w6-h7p6-cjj8CGA-cwrc-v2r6-q3mqCGA-f75p-9xjr-rhwhCGA-f7fc-f2wp-rgrpCGA-frf8-r7hj-fff8CGA-g4q3-fmvv-xv67CGA-g78h-4h8p-jh9vCGA-ggg6-7752-725qCGA-grph-rrh2-qhc8CGA-h32c-4jx5-pp29CGA-h6p4-33hq-xw68CGA-h7wg-4mxw-v257CGA-h8h4-jm45-xmccCGA-hv6x-grmf-x8v9CGA-j29v-pvcq-pr98CGA-jpj2-3228-rc46CGA-jq7q-wv6g-9gg5CGA-m6r5-f6qr-98j9CGA-mhf3-44v4-9wqwCGA-mhf8-7rvh-rgx9CGA-mpwf-j32q-r6wqCGA-mvgx-j4fj-975fCGA-mwv4-86v2-wgj9CGA-p62h-6rr5-39xxCGA-p9qm-42mm-4cxmCGA-pcr7-x78p-vxvxCGA-pf6j-vxq3-j3pgCGA-qcc2-vfp9-vh73CGA-qwpv-69f2-8ghmCGA-qxcm-j554-wmc6CGA-qxv2-m2vg-pmr3CGA-r235-48ch-2cv4CGA-r3cj-2cvq-pgqxCGA-r3w3-gjv9-m8mwCGA-r56f-33x2-3392CGA-r7qh-v6j7-88j7CGA-rcfp-wr75-mrq6CGA-rcm2-phhr-8w54CGA-rm47-54jh-58x6CGA-rmvp-9g7g-j263CGA-rrpq-2prq-53vcCGA-vcmq-mx3f-x835CGA-vrfr-38xf-56wqCGA-vw96-46xx-9w6pCGA-wp4v-3q2v-882gCGA-x4j2-h8qg-qp97CGA-x5fp-hcxc-4hx9CGA-x7rf-fxxp-4696CGA-xh5q-8mhf-fp58CGA-xrpv-pg73-66hrCGA-3fpx-m7mv-3hr7CGA-3g4p-xhp5-4w67CGA-3w8q-j93w-4cw8CGA-4f87-qrh6-3394CGA-4j68-mwgj-9qcqCGA-5534-3jf6-9vw5CGA-5qhj-w67x-24jpCGA-5v26-fm5c-45cmCGA-65wr-p98r-jgjcCGA-6x48-vx6c-66wvCGA-7gfx-6fpp-77mpCGA-7h6x-69v2-qf73CGA-8xp6-4ggj-grcqCGA-9xm2-5rg8-m9jmCGA-f3qv-w4h4-rxh8CGA-f7xf-5vcj-x5fjCGA-f9x4-726p-x858CGA-gfhf-cv29-v573CGA-h67p-5gmj-f25wCGA-h7wq-3g7g-mhmqCGA-jqf8-v85p-2p3gCGA-jw76-ww37-wr25CGA-jxg5-c4gp-xv9xCGA-jxrw-rw6v-7h28CGA-m2xv-f38r-cg8vCGA-p7vg-mwc7-rh23CGA-q7gr-59g5-cj92CGA-rvh2-465c-2p9cCGA-rx6w-2p6r-fh7jCGA-wfhw-cwrv-q4rpCGA-wmgp-59x7-2m43CGA-wvw9-8vq3-5mhjCGA-xh7q-pp9r-87xcCGA-2996-wjhf-94m9CGA-299j-mp52-8x6gCGA-2cjv-7m4v-4933CGA-2hcx-v9h4-g573CGA-3587-5hpc-8vfhCGA-3fp3-7fgf-5mfhCGA-3mc5-gcvj-924rCGA-3vpr-f6x7-x4rrCGA-3xq9-w96w-h446CGA-4923-9968-56rwCGA-4f7m-fv55-57r3CGA-4g3h-rh4r-6cm5CGA-4m35-p6xp-hfxrCGA-4p2j-fg7m-495cCGA-4wm6-wg6f-29wgCGA-5f5v-xm93-rp9jCGA-5frj-wr65-g8h2CGA-5h4r-x5mx-8mmvCGA-5j62-576c-xrh3CGA-5j6c-h4vv-fp72CGA-5j9m-9xc5-h35wCGA-5vg6-6pwq-rv32CGA-5xgr-8487-jw3wCGA-68q3-v2h8-968gCGA-75xh-c7p3-ppggCGA-c823-jqmf-pcwwCGA-c9fv-jv2h-m3xmCGA-cp88-p77w-h6q5CGA-fgv7-h8rw-2695CGA-fr58-x2xq-p8mhCGA-g2vh-5rf4-338gCGA-g3v5-x56v-vrhgCGA-g85f-cf57-37wxCGA-gc5r-49wq-629jCGA-ggv4-6gx7-jp3wCGA-gx8m-gwmw-r7f5CGA-hf9p-94xf-p862CGA-hw2c-v9w9-mjj5CGA-j673-r857-p8w3CGA-jq67-r7x2-2cg9CGA-jr9r-w9qm-32vjCGA-m52f-wfxq-qf56CGA-mmhx-mxv5-m7xqCGA-mqw3-m4hr-35f3CGA-mv37-4j7r-3h74CGA-q3qf-f2w5-r9f9CGA-q5w3-jm8h-43qcCGA-qmcr-2fhf-7wx7CGA-qqmw-gfcr-299xCGA-qqq6-vpf2-mpg6CGA-qv65-jhf7-245rCGA-r5r5-867p-2xxgCGA-rjjf-3mq9-xm85CGA-vh7f-57xj-36ffCGA-vhjr-jpf6-gfg5CGA-vq7j-pc6j-fw8vCGA-vv2x-2rv8-g8g9CGA-vwjh-2c4g-g9h4CGA-w7x4-8g6c-59m6CGA-w843-g676-vq8vCGA-x3cp-v7c7-5j7hCGA-x4q8-vhvw-p2rfCGA-x6gr-hp7g-97h8CGA-x6jx-m4xw-vpvvCGA-2g5p-7c5j-fp5wCGA-2g5p-9rfp-fx6cCGA-2w29-73h7-m34qCGA-2x3w-g556-x5rxCGA-329r-pq55-84pjCGA-3mmv-x8x9-hg77CGA-4952-3x8g-p637CGA-4f7p-6q7x-r9grCGA-4ghr-hqqx-6f85CGA-5mw4-f2r4-j2v3CGA-63rc-85hg-4pfxCGA-677v-2xp7-28g9CGA-6h7r-m2vc-8gj4CGA-727h-v3v2-cpx5CGA-7rfq-f432-73mcCGA-8776-93xg-v7q6CGA-8vmm-vx8v-jcr6CGA-9735-vq2m-fqpxCGA-9m88-v3qx-rgvxCGA-c9mg-p28v-gw2vCGA-crrx-2gfh-f75wCGA-cwqr-cgg5-xh2rCGA-fpmw-f8vr-ffwwCGA-g4q5-g87r-82xjCGA-g677-p6pr-fpcwCGA-gg8v-3pwh-rr37CGA-gj9j-wcj6-w58pCGA-h3fj-626h-pxjjCGA-hjx9-x95h-mwrqCGA-j3pp-x9w9-jwhcCGA-j8wr-r686-68x3CGA-jxxc-5cc5-4cv4CGA-m588-6925-wh8wCGA-mvph-9xc8-8747CGA-p992-969j-2rwjCGA-pjq5-cv3f-c7ggCGA-pm29-p2q8-pc6wCGA-pm85-c65p-f928CGA-q3mm-qhq6-m8gwCGA-q4qv-hq2q-fcpmCGA-v8hm-pg36-xwrgCGA-vc6v-7wjq-86jpCGA-vh9v-jj5h-g286CGA-vw7v-4f45-rc5fCGA-w59r-9pgq-fcgcCGA-wgg8-w23q-4p6xCGA-x9p6-j263-p27g
Advisory lineage Upstream: 0 Downstream: 20
Modified
Published: 02 Oct 2022, 00:00
Last modified:03 Aug 2024, 12:56
Vulnerability Summary
Overall Risk (default)
medium
41/100 CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
2.78% LOW
3% probability +2.45%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected
Timeline
02 Oct 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 12:56
Last Modified
Vulnerability information updated
Description
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 2.78%• Percentile: 86%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•cassandra-5.0
< 5.0.3-r2
- chainguard•cassandra-5.0-compat
< 5.0.3-r2
- chainguard•cassandra-5.0-entrypoint-compat
< 5.0.3-r2
- chainguard•cassandra-5.0-iamguarded-compat
< 5.0.3-r2
- chainguard•cassandra-fips-5.0
< 0
- chainguard•cassandra-fips-5.0-compat
< 0
- chainguard•cassandra-reaper
< 4.0.1-r1
- chainguard•cqlsh-5.0
< 5.0.3-r2
- chainguard•cqlsh-fips-5.0
< 0
- chainguard•druid
< 0
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•eco-java-gradle-5.0
all
- chainguard•eco-java-gradle-5.1
all
- chainguard•eco-java-gradle-5.1.1
all
- chainguard•eco-java-gradle-5.2
all
- chainguard•eco-java-gradle-5.2.1
all
- chainguard•eco-java-gradle-5.3
all
- chainguard•eco-java-gradle-5.3.1
all
- chainguard•eco-java-gradle-5.4
all
- chainguard•eco-java-gradle-5.4.1
all
- chainguard•eco-java-gradle-5.5
all
Showing first 50 affected entries in server-rendered view.
References (20)
- https://github.com/FasterXML/jackson-databind/issues/3590
- https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020
- https://security.gentoo.org/glsa/202210-21
- https://www.debian.org/security/2022/dsa-5283
- https://security.netapp.com/advisory/ntap-20221124-0004/
- https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-42003
- https://github.com/FasterXML/jackson-databind/issues/3627
- https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1
- https://github.com/FasterXML/jackson-databind/commit/2c4a601c626f7790cad9d3c322d244e182838288
- https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc
- https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea
- https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45
- https://security.netapp.com/advisory/ntap-20221124-0004
- https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.13.4.1...jackson-databind-2.13.4.2
- https://github.com/FasterXML/jackson-databind/commits/jackson-databind-2.4.0-rc1?after=75b97b8519f0d50c62523ad85170d80a197a2c86+174&branch=jackson-databind-2.4.0-rc1&qualified_name=refs%2Ftags%2Fjackson-databind-2.4.0-rc1
- https://github.com/FasterXML/jackson-databind/blob/2.13/release-notes/VERSION-2.x
- https://github.com/FasterXML/jackson-databind
- https://security-tracker.debian.org/tracker/CVE-2022-42003