Deserialization of Untrusted Data in Gson - CVE-2022-25647

Vulnerability identifier: #VU64152

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-25647

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insecure input validation when processing serialized data passed to writeReplace() method. A remote attacker can pass specially crafted data to the application and perform a denial of service attack.

Gson
watsonx.data
IBM Security Guardium
Debian Linux
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Development Tools
openSUSE Leap
Ubuntu
openEuler
Cognos Dashboards on Cloud Pak for Data
IBM Planning Analytics Workspace
IBM Watson Machine Learning Accelerator
Oracle Banking Platform
Guardium Data Security Center (GDSC)
DataStage on Cloud Pak for Data
Oracle Healthcare Master Person Index
Oracle BI Publisher
Oracle Business Intelligence Enterprise Edition
IBM Sterling Connect:Direct for Microsoft Windows
Maximo Application Suite - IoT Component
Oracle Data Integrator
Oracle Application Testing Suite
Oracle FLEXCUBE Universal Banking
Oracle Retail Order Broker
Oracle Banking Digital Experience
Cloud Pak for Network Automation
PowerStore T
IBM Cloud Pak for Watson AIOps
User Entity Behavior Analytics
Storage Virtualize
Solutions Enabler
Unisphere 360
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
eVASA Provider Virtual Appliance
VASA Provider Standalone
eap7-jboss-jsf (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-jberet (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-netty-tcnative (Red Hat package)
eap7-wildfly-openssl (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
libgoogle-gson-java (Ubuntu package)
eap7-wildfly-openssl-el7 (Red Hat package)
eap7-wildfly-openssl-el8 (Red Hat package)
eap7 (Red Hat package)
eap7-glassfish-jsf (Red Hat package)
eap7-jandex (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-picketlink-bindings (Red Hat package)
google-gson
libgoogle-gson-java (Debian package)
eap7-gson (Red Hat package)
google-gson-javadoc
eap7-apache-cxf (Red Hat package)
eap7-javapackages-tools (Red Hat package)
eap7-picketbox (Red Hat package)
BIG-IP
tink
IBM Watson Assistant for IBM Cloud Pak for Data
Cryostat
Crucible Server
Jira Service Management Data Center
Jira Service Management Server
IBM Sterling Connect:Direct for UNIX
Oracle Communications WebRTC Session Controller
Oracle Communications Unified Inventory Management
IBM Db2 Mirror for i
Jira Software Data Center
Oracle Financial Services Model Management and Governance
Oracle Healthcare Data Repository
Oracle Communications Performance Intelligence Center (PIC) Software
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Enterprise Manager Base Platform
Oracle Banking Treasury Management
Oracle Banking Trade Finance
Oracle Banking APIs
Oracle Blockchain Platform
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Automated Test Suite
IBM Operations Analytics Predictive Insights
Log Analysis
Netcool Operations Insight
IBM Cloud Pak for Data System
Red Hat Integration - Service Registry
QRadar User Behavior Analytics
IBM Sterling B2B Integrator
IBM Cloud Application Performance Management (APM)
IBM Spectrum Protect Storage Agent
IBM Security Verify Governance
IBM Observability with Instana
Vert.x
Oracle Utilities Testing Accelerator
Oracle Financial Services Crime and Compliance Management Studio
Oracle Business Activity Monitoring
Documaker Enterprise Edition
Stream Analytics
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Banking Corporate Lending
BIG-IQ Centralized Management
JBoss Enterprise Application Platform
Oracle WebLogic Server
AMQ Streams
IBM Qradar SIEM
Jira Software Server
Cloud Pak for Security (CP4S)
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Oracle Banking Payments
Oracle Retail Customer Management and Segmentation Foundation
Oracle Retail EFTLink
Oracle GraalVM Enterprise Edition
Solutions Enabler Virtual Appliance
Siebel Core - Automation
Siebel Core - Common Components
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Policy
Voice Gateway
IBM Disconnected Log Collector

Install updates from vendor's website.

Gson - update to 2.8.9
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-5.SP06_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-5.SP06_redhat_00001.1.el8eap
tink - update to 1.7.0
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.12-1.SP1_redhat_00001.1.el7eap, 1.1.12-1.SP1_redhat_00001.1.el8eap
eap7-jberet (Red Hat package) - addressed in versions 1.3.9-2.SP2_redhat_00001.1.el7eap, 1.3.9-2.SP2_redhat_00001.1.el8eap
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.6
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.3-2.SP1_redhat_00001.1.el7eap, 1.5.3-2.SP1_redhat_00001.1.el8eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-18.Final_redhat_00017.1.el7eap, 1.10.0-18.Final_redhat_00017.1.el8eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.13-1.Final_redhat_00001.1.el7eap, 1.15.13-1.Final_redhat_00001.1.el8eap
Cryostat - update to 2.1.1
eap7-netty-tcnative (Red Hat package) - addressed in versions 2.0.52-1.Final_redhat_00001.1.el7eap, 2.0.52-1.Final_redhat_00001.1.el8eap
eap7-wildfly-openssl (Red Hat package) - addressed in versions 2.2.3-1.Final_redhat_00001.1.el7eap, 2.2.3-1.Final_redhat_00001.1.el8eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.18-2.SP2_redhat_00001.1.el7eap, 2.2.18-2.SP2_redhat_00001.1.el8eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.12.6.1-2.redhat_00004.1.el7eap, 2.12.6.1-2.redhat_00004.1.el8eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.13-1.Final_redhat_00001.1.el7eap, 3.3.13-1.Final_redhat_00001.1.el8eap
Guardium Data Security Center (GDSC) - update to 3.6.1
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.77-1.Final_redhat_00001.1.el7eap, 4.1.77-1.Final_redhat_00001.1.el8eap
eap7-netty (Red Hat package) - addressed in versions 4.1.77-1.Final_redhat_00001.1.el7eap, 4.1.77-1.Final_redhat_00001.1.el8eap
Vert.x - update to 4.2.7
Crucible Server - update to 4.8.15
DataStage on Cloud Pak for Data - update to 4.8.5
Jira Service Management Data Center - addressed in versions 4.20.25, 5.4.9, 5.7.2, 5.8.2, 5.9.2, 5.10.1, 5.11.0
Jira Service Management Server - addressed in versions 4.20.25, 5.4.9, 5.7.2, 5.8.2, 5.9.2, 5.10.1, 5.11.0
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.25-1.SP1_redhat_00001.1.el7eap, 5.0.25-1.SP1_redhat_00001.1.el8eap
eap7-hibernate (Red Hat package) - addressed in versions 5.3.27-1.Final_redhat_00001.1.el7eap, 5.3.27-1.Final_redhat_00001.1.el8eap
IBM Sterling Connect:Direct for UNIX - update to 6.2.0.4.18
IBM Sterling Connect:Direct for Microsoft Windows - update to 6.2.0.4.12
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.0
JBoss Enterprise Application Platform - update to 7.4.6
eap7-wildfly (Red Hat package) - addressed in versions 7.4.6-5.GA_redhat_00002.1.el7eap, 7.4.6-5.GA_redhat_00002.1.el8eap
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5, 7.5.0 Update Pack 8
Jira Software Data Center - addressed in versions 8.20.28, 9.4.19, 9.11.3
Jira Software Server - addressed in versions 8.20.28, 9.4.19, 9.11.3
Maximo Application Suite - IoT Component - addressed in versions 8.7.28, 8.8.24, 9.0.14, 9.1.5
Oracle Banking Corporate Lending - update to 14.4
Oracle FLEXCUBE Universal Banking - update to 14.3.0
Stream Analytics - update to 19.1.0.0.8
Oracle Blockchain Platform - update to 21.1.3
libgoogle-gson-java (Ubuntu package) - addressed in versions Ubuntu Pro, 2.8.5-3+deb10u1build0.20.04.1, 2.8.8-1ubuntu0.1
eap7-wildfly-openssl-el7 (Red Hat package) - update to x86_64-2.2.2-1.Final_redhat_00002.1.el7eap
eap7-wildfly-openssl-el8 (Red Hat package) - update to x86_64-2.2.2-1.Final_redhat_00002.1.el8eap
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
IBM Operations Analytics Predictive Insights - update to 1.3.6.6
Log Analysis - update to 1.3.7 FP2
Netcool Operations Insight - update to 1.6.10
IBM Disconnected Log Collector - update to 1.8.3
Cloud Pak for Security (CP4S) - update to 1.10.14.0
eap7 (Red Hat package) - update to 1-18.el9eap
watsonx.data - update to 2.0.2
IBM Cloud Pak for Data System - update to 2.0.2.1
AMQ Streams - update to 2.2.0
Red Hat Integration - Service Registry - update to 2.3.0
eap7-glassfish-jsf (Red Hat package) - addressed in versions 2.3.14-4.SP05_redhat_00001.1.el7eap, 2.3.14-4.SP05_redhat_00001.1.el8eap
eap7-jandex (Red Hat package) - addressed in versions 2.4.2-1.Final_redhat_00001.1.el7eap, 2.4.2-1.Final_redhat_00001.1.el8eap
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-21.SP12_redhat_00011.1.el7eap, 2.5.5-21.SP12_redhat_00011.1.el8eap
eap7-picketlink-bindings (Red Hat package) - addressed in versions 2.5.5-26.SP12_redhat_00014.1.el7eap, 2.5.5-26.SP12_redhat_00014.1.el8eap
Cloud Pak for Network Automation - update to 2.6.0
google-gson - update to 2.8.2-4
libgoogle-gson-java (Debian package) - update to 2.8.6-1+deb11u1
eap7-gson (Red Hat package) - addressed in versions 2.8.9-1.redhat_00001.1.el7eap, 2.8.9-1.redhat_00001.1.el8eap
google-gson - addressed in versions 2.8.9-150200.3.6.3, 2.8.9-150200.3.7.1
google-gson-javadoc - update to 2.8.9-150200.3.6.3
eap7-apache-cxf (Red Hat package) - addressed in versions 3.3.13-1.redhat_00001.1.el7eap, 3.3.13-1.redhat_00001.1.el8eap
eap7-javapackages-tools (Red Hat package) - update to 3.4.1-5.15.6.el9eap
PowerStore T - update to 3.5.0.1-2083289
IBM Cloud Pak for Watson AIOps - update to 4.1
QRadar User Behavior Analytics - update to 4.1.16
User Entity Behavior Analytics - update to 5.0.2
eap7-picketbox (Red Hat package) - addressed in versions 5.0.3-10.Final_redhat_00009.1.el7eap, 5.0.3-10.Final_redhat_00009.1.el8eap
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.6, 6.1.1.3, 6.1.2.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
IBM Spectrum Protect Storage Agent - update to 8.1.19
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
Solutions Enabler - update to 9.2.3.5
Solutions Enabler Virtual Appliance - update to 9.2.3.5
Unisphere 360 - update to 9.2.3.8
Unisphere for PowerMax - update to 9.2.3.20
Unisphere for PowerMax Virtual Appliance - update to 9.2.3.20
eVASA Provider Virtual Appliance - update to 9.2.4.11
VASA Provider Standalone - update to 9.2.4.21
IBM Security Verify Governance - update to 10.0.2
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.4
IBM Observability with Instana - update to 269

• https://github.com/google/gson/pull/1991

• Denial of service in Google Gson
• Denial of service in IBM Db2 Mirror for i
• Multiple vulnerabilities in Cryostat
• SUSE update for google-gson
• Multiple vulnerabilities in Eclipse Vert.x
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Multiple vulnerabilities in Oracle Retail Order Broker
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Denial of service in IBM Sterling Connect:Direct for Microsoft Windows
• Multiple vulnerabilities in tink
• IBM Sterling Connect:Direct for UNIX update for Google Gson
• Denial of service in F5 BIG-IP iAppsLX component
• Denial of service in BIG-IQ Centralized Management iControl REST framework
• Debian update for libgoogle-gson-java
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Red Hat Integration - Service registry
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in Dell products
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications WebRTC Session Controller
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Healthcare Master Person Index
• Deserialization of Untrusted Data in Oracle Healthcare Data Repository
• Multiple vulnerabilities in Documaker Enterprise Edition
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Multiple vulnerabilities in Siebel Core - Common Components
• Deserialization of Untrusted Data in Siebel Core - Automation
• Multiple vulnerabilities in Oracle Retail EFTLink
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in Oracle BI Publisher
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle Data Integrator
• SUSE update for google-gson
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Deserialization of untrusted data in IBM Watson Assistant for IBM Cloud Pak for Data
• Deserialization of untrusted data in IBM Sterling B2B Integrator
• Deserialization of Untrusted Data in Oracle Communications Performance Intelligence Center (PIC) Software
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Stream Analytics
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Deserialization of untrusted data in IBM Security Guardium
• Multiple vulnerabilities in IBM Voice Gateway
• Deserialization of untrusted data in IBM Cloud Pak for Data System
• Multiple vulnerabilities in Oracle Blockchain Platform
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Multiple vulnerabilities in Oracle Banking Payments
• Multiple vulnerabilities in Oracle Banking Corporate Lending
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Deserialization of untrusted data in IBM Operations Analytics - Log Analysis
• Deserialization of untrusted data in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Business Activity Monitoring
• Deserialization of untrusted data in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Deserialization of untrusted data in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Jira Service Management Data Center and Server update for Google Gson
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Deserialization of Untrusted Data in Oracle Application Testing Suite
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in third-party components in Jira Software Data Center and Server
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in Netcool Operations Insight
• openEuler update for google-gson
• Ubuntu update for libgoogle-gson-java
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Crucible Data Center and Server update for Google gson
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Storage Virtualize
• Deserialization of untrusted data in IBM watsonx.data
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component