Resource exhaustion in Codehaus Jettison - CVE-2022-40150

Vulnerability identifier: #VU69674

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40150

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing untrusted XML or JSON data. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Codehaus Jettison
Red Hat Camel for Spring Boot
Debian Linux
Ubuntu
openEuler
CICS Transaction Gateway
IBM Process Mining
IBM Spectrum Copy Data Management
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
Dell Secure Connect Gateway
IBM Sterling B2B Integrator
UCD - IBM UrbanCode Deploy
Jira Software Data Center
Red Hat Integration Camel Extensions for Quarkus
IBM Cloud Transformation Advisor
IBM Sterling External Authentication Server
IBM Sterling Secure Proxy
IBM UrbanCode Release
IBM Data Risk Manager
Oracle Utilities Application Framework
DataStage on Cloud Pak for Data
IBM Engineering Requirements Management DOORS Next
Oracle Business Intelligence Enterprise Edition
Oracle Siebel CRM
Cloud Pak for Network Automation
IBM Cloud Pak for Watson AIOps
UrbanCode Build
SecureTransport
JBoss Enterprise Application Platform
Oracle WebLogic Server
AMQ Streams
Red Hat Single Sign-On
Jira Software Server
IBM Qradar SIEM
Oracle Communications Billing and Revenue Management
libjettison-java (Ubuntu package)
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
libjettison-java (Debian package)
jettison
jettison-javadoc
eap7-ironjacamar (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-jackson-databind (Red Hat package)
jenkins (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Disconnected Log Collector
watsonx.data
RSA Authentication Manager

Install updates from vendor's website.

Codehaus Jettison - update to 1.5.1
IBM Process Mining - update to 1.13.2
IBM Data Risk Manager - update to 2.0.6.15
IBM Spectrum Copy Data Management - update to 2.2.18
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
DataStage on Cloud Pak for Data - update to 4.8.5
SecureTransport - addressed in versions 5.5-20220929, 5.5-20221027
Dell Secure Connect Gateway - update to 5.16
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.1.4, 6.1.2.3, 6.2.0.0
UCD - IBM UrbanCode Deploy - addressed in versions 6.2.7.18, 7.0.5.13, 7.1.2.9, 7.2.3.2
JBoss Enterprise Application Platform - update to 7.4.9
Red Hat Single Sign-On - update to 7.6.2
Jira Software Data Center - addressed in versions 9.4.16, 9.9.0
Jira Software Server - addressed in versions 9.4.16, 9.9.0
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
Oracle Siebel CRM - update to 23.5
libjettison-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.0-1ubuntu0.20.04.1, 1.4.1-1ubuntu0.22.04.1, 1.4.1-1ubuntu0.22.10.1
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
eap7-jettison (Red Hat package) - addressed in versions 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap
libjettison-java (Debian package) - update to 1.5.3-1~deb11u1
jettison - update to 1.5.4-1
jettison-javadoc - update to 1.5.4-1
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
IBM Disconnected Log Collector - update to 1.8.3
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
watsonx.data - update to 2.0.3
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
AMQ Streams - update to 2.4.0
Cloud Pak for Network Automation - update to 2.4.4
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
Red Hat Integration Camel Extensions for Quarkus - update to 2.13.2
jenkins (Red Hat package) - addressed in versions 2.401.1.1686649641-3.el8, 2.401.1.1686831596-3.el8
eap7-hal-console (Red Hat package) - addressed in versions 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
IBM Cloud Transformation Advisor - update to 3.4.2
IBM Cloud Pak for Watson AIOps - update to 3.6.1
Red Hat Camel for Spring Boot - update to 3.20.1
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
jenkins-2-plugins (Red Hat package) - addressed in versions 4.11.1686831822-1.el8, 4.12.1686649756-1.el8
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
IBM Sterling External Authentication Server - addressed in versions 6.0.3.0 iFix 08, 6.1.0.0 iFix 04
IBM Sterling Secure Proxy - update to 6.0.3 iFix 08
UrbanCode Build - update to 6.1.7.10
IBM UrbanCode Release - update to 6.2.5.11
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
RSA Authentication Manager - update to 8.7 Patch 3
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549
• https://github.com/jettison-json/jettison/issues/45

• Multiple vulnerabilities in Jettison
• IBM UrbanCode Deploy update for Jettison
• Multiple vulnerabilities in IBM CICS Transaction Gateway
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in IBM Process Mining
• Debian update for libjettison-java
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Axway SecureTransport (September 2022)
• Multiple vulnerabilities in Axway SecureTransport (October 2022)
• IBM Watson Discovery Cartridge for IBM Cloud Pak for Data update for Jettison
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Multiple vulnerabilities in Red Hat AMQ Streams 2.4
• OpenShift Developer Tools and Services for OCP 4.12 update for jenkins and jenkins-2-plugins
• Ubuntu update for libjettison-java
• OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Oracle Siebel CRM
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM UrbanCode Build
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Disconnected Log Collector
• openEuler update for jettison
• Jira Software Data Center and Server update for jettison
• openEuler 20.03 LTS SP4 update for jettison
• IBM watsonx.data update for Jettison
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in Oracle Utilities Application Framework
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS and DOORS Web Access