CVE-2022-42004

Aliases:GHSA-rgv9-q543-rqg4DEBIAN-CVE-2022-42004CGA-37qp-p822-962jCGA-45gm-pjfv-c372CGA-4wh4-837w-3j6pCGA-556r-qp4q-cmp9CGA-5pwh-4fqw-94wmCGA-63gf-pcj8-9wpqCGA-6grv-f79c-2mxhCGA-737h-xhww-hqcfCGA-7hf4-5673-2cvfCGA-8cxw-c73c-qhx9CGA-9prm-7fh2-rjv7CGA-cvwg-w8p9-7q7cCGA-fg8w-3q6g-g28gCGA-fr27-5v68-pp6gCGA-fv5j-w7mw-r57pCGA-jc8q-xxpv-mhqqCGA-mw8c-5gp7-4m67CGA-pf79-9ffm-6ccjCGA-253f-jc94-x8fxCGA-28j3-2pqh-5fwxCGA-2ggq-3752-hpmjCGA-364c-6jqj-57ghCGA-37hg-h4hg-p6jqCGA-398r-5rwr-mmrqCGA-3j9h-ghvh-xm3rCGA-3p7r-jpfm-3hhrCGA-479x-7frh-x99gCGA-5874-vv85-3p4pCGA-5hgw-f57j-6m72CGA-5w57-fjgh-5r3jCGA-6352-c82v-h83qCGA-6c32-4rmq-j56hCGA-6cfm-gm8p-8qjrCGA-7cgp-8mqg-39mgCGA-85wh-gq8q-xppcCGA-8ffm-9mc3-wp76CGA-8prx-gg27-xf5cCGA-8xhj-5g7r-2mwqCGA-9384-w2v6-m786CGA-9p8v-gvvh-gwqjCGA-9q3f-693j-6p94CGA-c2f4-q478-qvwvCGA-c8h6-qrmq-chw9CGA-cw28-r342-9mjqCGA-f22f-pv9r-mjg8CGA-f6wc-gqhc-g96xCGA-gh8r-25j6-c62hCGA-grwr-x4g5-5j89CGA-h235-4jc8-39qxCGA-h354-f2vm-vwp2CGA-h39p-4rm3-fg35CGA-h7gm-p3cj-pgp9CGA-h8rv-hr79-xjfqCGA-h97h-r5hj-mc9jCGA-hg37-pq5m-pg7cCGA-hq79-rqm3-7gxfCGA-hqp9-28m5-84cvCGA-hqrq-q5xj-22wfCGA-j27g-h3fq-rp2mCGA-j3jc-8ghc-v7j6CGA-j424-mw5h-8mwhCGA-jfp4-jc5w-8m6qCGA-jm34-2vxh-3f9fCGA-jr7q-xhx4-9hrcCGA-jvmh-7h6r-qccpCGA-jwr8-3r78-mhmrCGA-m733-xppc-46g9CGA-mcq4-7jf3-j357CGA-mf44-7c7r-f4ggCGA-mg7v-p8gg-w3qhCGA-mxr8-x394-74w5CGA-p5m6-482m-pfgrCGA-p63m-q47h-4hg4CGA-p7vp-2hqj-672rCGA-p9v2-g4v7-4577CGA-pgh8-p33v-6mg5CGA-q6hr-fq6h-6crxCGA-q7hv-j7pr-xwpvCGA-q7vx-fv5f-g7ghCGA-qhgx-pxhq-x9p7CGA-qp5v-4793-8mrgCGA-qqhj-qc72-7gxcCGA-qw26-5hjx-4hh2CGA-r3pv-4f3f-7x7vCGA-r9j2-w2qv-qpgmCGA-rfmq-fqf3-rfj5CGA-rmr8-pjqh-ghw7CGA-v2cw-7cm8-fc37CGA-v329-r43p-j7rmCGA-v42h-5crr-9468CGA-v5cr-q7jc-g82xCGA-v78g-pf5m-p3f3CGA-vgrx-278r-56j8CGA-vh3j-58vc-x4qmCGA-vqx9-j72c-mg8gCGA-w3x4-2h9v-jhxcCGA-wf9m-q63q-6q8jCGA-wpc3-wf4j-5jffCGA-wx67-jgfj-r287CGA-x3wm-wjjw-7745CGA-x4qp-gq48-rgrwCGA-xc8v-gpj2-w8gqCGA-xh89-6768-mc3gCGA-xm3q-cqgw-m7r6CGA-xmjj-7cjm-gr36CGA-34xf-7jmq-gjfhCGA-468c-pp42-84xxCGA-5rrp-f52p-pj98CGA-7j46-pq3j-3728CGA-7j5v-vpx9-583cCGA-8mpw-h9qv-mgv2CGA-cg28-444m-w845CGA-fj9v-q3c3-x5g7CGA-g5c9-94cv-p3h4CGA-g77q-8j56-hg2pCGA-gh2c-66fw-rfgvCGA-gwqv-fw43-6c74CGA-gwxw-6gw4-w7v7CGA-hrgw-m4x4-hrqfCGA-jhvp-54pm-c53mCGA-jqqq-9ffg-j7rpCGA-p26v-9qqm-w488CGA-p5p5-vqgw-p52mCGA-qmqq-52r3-xp7jCGA-r54q-3476-p2qcCGA-rvfh-qr3p-p8r8CGA-v4mq-gmpj-x3gfCGA-vj5h-3m92-6qrgCGA-vvrr-hhvr-jpm2CGA-w2q4-c2wp-7fgqCGA-w8j3-3vf6-qc5fCGA-x2fj-h5fr-crm9CGA-x3vr-mgvr-x8pvCGA-x458-gf42-8946CGA-2mx6-cx3h-v6jrCGA-2rwx-v9xg-r9vrCGA-4c3w-v32g-4q8fCGA-4g6f-mqw7-fwh2CGA-4mg8-v934-rpm3CGA-4xp9-ff7x-f8qrCGA-57w6-r5xh-jmrrCGA-5884-gqjp-pjp6CGA-58rg-rx9x-w6g3CGA-5c69-jcwg-6mppCGA-5c9x-v7gq-phwpCGA-5vg4-x8gc-f3p9CGA-6hcf-fhgq-62x6CGA-6vfx-fqr6-qwf9CGA-7gmc-xqw9-77mfCGA-7m5v-wprm-86r6CGA-7qxc-r6jh-gpr2CGA-7vcm-253h-f4rgCGA-8x9r-c88x-9pxxCGA-93fm-8xhq-rw2pCGA-93v8-m375-r9rrCGA-c255-4jcc-grf4CGA-c785-2qhr-4x8pCGA-cgmq-g2g6-9c9pCGA-cqjj-768w-wgg4CGA-cvf3-jx38-m5p2CGA-cxxx-cc24-9vc6CGA-f87v-8wx9-fw4mCGA-fp45-372f-8q4gCGA-frcr-87pq-46xhCGA-g6fw-jq77-58jrCGA-g6pg-r2wc-64qfCGA-gcvr-q5v7-68m3CGA-hprr-8p22-pm65CGA-hv4p-v4v7-ggv3CGA-hw53-qmgq-c87pCGA-hwq8-wfh8-jxjjCGA-j55r-fg94-f367CGA-jc5h-3rwv-6856CGA-jf72-xww3-42hfCGA-jg35-j2wv-r48pCGA-jqwj-pc6v-r5hmCGA-jv98-9vvf-hhjmCGA-mq54-vvvx-85r7CGA-p69x-c5qh-m3r2CGA-pq49-88j6-6vv3CGA-q9gx-495h-h943CGA-qf4q-3mj8-793gCGA-qgx5-fp67-fcqxCGA-qr2h-fv5f-2h63CGA-r3mq-7r9c-qgh4CGA-rhpv-xffj-58cfCGA-rr88-fjwj-jjjcCGA-rx3v-ppx7-hx27CGA-v2j4-5v39-qvv2CGA-v3vc-fvgp-6wggCGA-v6xj-pf6w-57wgCGA-v7mm-mvg8-699mCGA-vf4g-v748-8m47CGA-vqf9-hxcm-269fCGA-w3gj-74wp-8492CGA-w4wx-2949-gjxrCGA-wfv5-9vcw-p4fcCGA-wq54-mq4x-8jphCGA-2r5p-j87p-4qwvCGA-3695-4g3m-9935CGA-3j4g-7692-mrm5CGA-3p42-w6f2-9gmmCGA-4fj7-fhw8-7w5hCGA-4hpm-j7r6-xx3qCGA-535x-mh47-76wpCGA-5576-26pv-33rhCGA-5cvw-j3q6-27xwCGA-64wc-m6h5-g77pCGA-67vc-h78v-38mwCGA-6g8c-w923-4824CGA-6pqp-fcwx-g9vcCGA-72v6-97x7-6h29CGA-75ww-44rh-8q9jCGA-83mr-hfjv-w387CGA-8fhw-fppx-3qvhCGA-8p6f-mjm2-gjg2CGA-c5gx-wmw2-rf4qCGA-cmvw-rfhp-9j2jCGA-cqrw-gh5v-36ggCGA-cw3q-35q2-7hvqCGA-f5f3-5p5c-x8wgCGA-f74j-h9wv-rjvwCGA-f8vp-p85h-53m3CGA-gcf8-vr9q-mm7qCGA-gh38-qq5x-pfh9CGA-gm59-c69g-gw8gCGA-gpfc-5gxm-42pjCGA-hx73-pr4p-55pqCGA-jx57-m6m8-6x5jCGA-m3rf-f3fp-j8wmCGA-m938-425m-r9x4CGA-mf36-f3r8-2v3qCGA-p52m-cc93-hf3xCGA-pc84-3vm3-92mrCGA-pcmf-48rm-wcx6CGA-q5jv-j8rm-xj88CGA-qjwq-w4w5-63p4CGA-qqq7-crrv-vpfcCGA-r4gq-xph8-7jv2CGA-r7qv-j3w7-vpxjCGA-rrc6-g2r8-xch8CGA-rv3h-q422-cpqfCGA-v2p4-m3r9-284mCGA-vh7x-4f5j-rx6pCGA-vxw5-6xmx-67pwCGA-wvfr-f9jw-v9c7CGA-x3f8-pqf5-fhqjCGA-xf9q-rr9r-jgjvCGA-xx4w-6hxv-p2q2
Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 02 Oct 2022, 00:00
Last modified:03 Aug 2024, 12:56

Vulnerability Summary

Overall Risk (default)
medium
41/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
2.78% LOW
3% probability +2.52%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

02 Oct 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 12:56
Last Modified
Vulnerability information updated

Description

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

CVSS Metrics

  • v4.0•HIGH•Score: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 2.78%• Percentile: 86%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•cassandra-5.0

    < 5.0.3-r2

  • chainguard•cassandra-5.0-compat

    < 5.0.3-r2

  • chainguard•cassandra-5.0-entrypoint-compat

    < 5.0.3-r2

  • chainguard•cassandra-5.0-iamguarded-compat

    < 5.0.3-r2

  • chainguard•cassandra-fips-5.0

    < 0

  • chainguard•cassandra-fips-5.0-compat

    < 0

  • chainguard•cassandra-reaper

    < 4.0.1-r1

  • chainguard•cqlsh-5.0

    < 5.0.3-r2

  • chainguard•cqlsh-fips-5.0

    < 0

  • chainguard•druid

    < 0

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

  • chainguard•eco-java-gradle-5.4

    all

  • chainguard•eco-java-gradle-5.4.1

    all

  • chainguard•eco-java-gradle-5.5

    all

Showing first 50 affected entries in server-rendered view.

References (14)