CVE-2022-45136 — Vulnerability in org.apache.jena:jena-sdb — CVE...
CRITICAL
Apache Jena vulnerable to Deserialization of Untrusted Data
Published November 14, 2022Updated August 2, 2024Source: osv
Summary
Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.
Advisory Timeline
- First published November 14, 2022 (1428 days ago).
- Last revised August 2, 2024 — 627 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: maven (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.jena:jena-sdb | maven | 1.3.5, 1.3.6, 1.4.0, 1.4.1 (+25 more) | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-502Deserialization of Untrusted DataMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Frequently Asked Questions
- What is CVE-2022-45136?
- Apache Jena vulnerable to Deserialization of Untrusted Data This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2022-45136?
- CVE-2022-45136 affects org.apache.jena:jena-sdb. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-45136 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-g2qw-6vrr-v6pq
Related CVEs
- CVE-2026-107726CRITICAL
Hazelcast allows arbitrary member memory access by low-privileged client
- CVE-2026-107282CRITICAL
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies