Out-of-bounds write in Codehaus Jettison - CVE-2022-45693

Vulnerability identifier: #VU71109

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-45693

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack..

The vulnerability exists due to a boundary error when processing data passed via the map parameter. A remote attacker can pass specially crafted input to the application, trigger an out-of-bounds write and perform a denial of service (DoS) attack.

Codehaus Jettison
Red Hat Camel for Spring Boot
Debian Linux
Ubuntu
openEuler
ObjectScale
DataStage on Cloud Pak for Data
IBM Engineering Requirements Management DOORS Next
Oracle Data Integrator
Cloud Pak for Network Automation
IBM Cloud Pak for Watson AIOps
UrbanCode Build
IBM Application Suite - IBM Asset Data Dictionary Component
IBM Process Mining
IBM Watson Knowledge Catalog in Cloud Pak for Data
Jira Service Management Server
Jira Service Management Data Center
Dell Secure Connect Gateway
IBM Sterling B2B Integrator
Jira Software Data Center
Oracle Banking Trade Finance
Oracle Banking Treasury Management
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling External Authentication Server
IBM Sterling Secure Proxy
Red Hat Migration Toolkit for Applications
IBM UrbanCode Release
UCD - IBM UrbanCode Deploy
CICS Transaction Gateway
SecureTransport
JBoss Enterprise Application Platform
Red Hat Single Sign-On
Jira Software Server
IBM Qradar SIEM
Identity Manager
libjettison-java (Ubuntu package)
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
libjettison-java (Debian package)
jettison-javadoc
jettison
eap7-ironjacamar (Red Hat package)
eap7-velocity (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
jenkins (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Disconnected Log Collector
watsonx.data
IBM Data Risk Manager
IBM Cloud Pak System

Install updates from vendor's website.

Codehaus Jettison - update to 1.5.2
ObjectScale - update to 1.3.0
IBM Process Mining - update to 1.14.0.0
Red Hat Camel for Spring Boot - update to 3.14.5 Patch 1
DataStage on Cloud Pak for Data - update to 4.8.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
SecureTransport - update to 5.5-20230126
Jira Service Management Server - update to 5.12.29
Jira Service Management Data Center - update to 5.12.29
Dell Secure Connect Gateway - update to 5.16
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.1.4, 6.1.2.3, 6.2.0.0
JBoss Enterprise Application Platform - addressed in versions 7.1.9, 7.3.12, 7.4.9
Red Hat Single Sign-On - update to 7.6.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
Jira Software Server - update to 9.12.29
Jira Software Data Center - update to 9.12.29
Oracle Banking Trade Finance - update to 14.4
libjettison-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.0-1ubuntu0.20.04.1, 1.4.1-1ubuntu0.22.04.1, 1.4.1-1ubuntu0.22.10.1
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
eap7-jettison (Red Hat package) - addressed in versions 1.3.8-2.redhat_00002.1.ep7.el7, 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap, 1.5.2-2.redhat_00002.1.el7eap
libjettison-java (Debian package) - update to 1.5.3-1~deb11u1
jettison-javadoc - update to 1.5.4-1
jettison - update to 1.5.4-1
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
IBM Disconnected Log Collector - update to 1.8.3
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-1.SP1_redhat_00001.1.el7eap, 1.33.0-1.SP1_redhat_00001.1.ep7.el7
watsonx.data - update to 2.0.3
IBM Data Risk Manager - update to 2.0.6.16
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
IBM Cloud Pak System - update to 2.3.3.6 iFix 1
Cloud Pak for Network Automation - update to 2.4.4
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7, 2.10.4-4.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.10.4-4.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
jenkins (Red Hat package) - update to 2.401.1.1686649641-3.el8
eap7-resteasy (Red Hat package) - addressed in versions 3.0.27-1.Final_redhat_00001.1.ep7.el7, 3.11.6-1.Final_redhat_00001.1.el7eap
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
eap7-hal-console (Red Hat package) - addressed in versions 3.2.17-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
IBM Cloud Pak for Watson AIOps - update to 3.6.1
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.63-1.Final_redhat_00002.1.ep7.el7, 4.1.63-4.Final_redhat_00002.1.el7eap
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
jenkins-2-plugins (Red Hat package) - update to 4.12.1686649756-1.el8
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
IBM Sterling External Authentication Server - addressed in versions 6.0.3.0 iFix 08, 6.1.0.0 iFix 04
IBM Sterling Secure Proxy - update to 6.0.3 iFix 08
UrbanCode Build - update to 6.1.7.10
Red Hat Migration Toolkit for Applications - update to 6.2
IBM UrbanCode Release - update to 6.2.5.11
UCD - IBM UrbanCode Deploy - addressed in versions 6.2.7.20, 7.0.5.15, 7.1.2.11, 7.2.3.4, 7.3.1.0
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.1.9-2.GA_redhat_00002.1.ep7.el7, 7.3.12-3.GA_redhat_00002.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Application Suite - IBM Asset Data Dictionary Component - addressed in versions 8.9.9, 8.10.4
CICS Transaction Gateway - addressed in versions 9.1.0.3, 9.2.0.2, 9.3.0.0
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso

• https://github.com/jettison-json/jettison/issues/52
• https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html

• Debian update for libjettison-java
• Multiple vulnerabilities in Jettison
• Information disclosure in Red Hat Camel for Spring Boot
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM CICS Transaction Gateway
• Multiple vulnerabilities in IBM UrbanCode Deploy (UCD)
• Multiple vulnerabilities in Axway SecureTransport (January 2023)
• Multiple vulnerabilities in Identity Manager
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Process Mining
• OpenShift Developer Tools and Services for OCP 4.12 update for jenkins and jenkins-2-plugins
• Ubuntu update for libjettison-java
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Application Suite - IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM UrbanCode Build
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• openEuler update for jettison
• openEuler 20.03 LTS SP4 update for jettison
• IBM watsonx.data update for Jettison
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in Oracle Data Integrator
• Jira Software Data Center and Server update for jettison
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Jira Service Management Data Center and Server update for org.codehaus.jettison:jettison
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS and DOORS Web Access