Log in Start free

Vulnerability · Published Nov 14, 2022 · Assigned by apache

CVE-2022-45136Apache Jena SDB allows arbitrary deserialisation via JDBC

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Apache Jena SDB from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.7%top 23.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12apache-jena4.5.0-1DEBIAN-CVE-2022-45136
Debian:13apache-jena4.5.0-1DEBIAN-CVE-2022-45136
Debian:14apache-jena4.5.0-1DEBIAN-CVE-2022-45136
Mavenorg.apache.jena:jena-sdbno fix listedGHSA-g2qw-6vrr-v6pq
Ubuntu:22.04:LTSapache-jenano fix listedUBUNTU-CVE-2022-45136
Ubuntu:24.04:LTSapache-jenano fix listedUBUNTU-CVE-2022-45136
Ubuntu:25.10apache-jenano fix listedUBUNTU-CVE-2022-45136
Ubuntu:26.04:LTSapache-jenano fix listedUBUNTU-CVE-2022-45136
Ubuntu:26.10apache-jenano fix listedUBUNTU-CVE-2022-45136
Ubuntu:22.04:LTSsdbno fix listedUBUNTU-CVE-2022-45136

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Jena SDB unspecified – through 3.17.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References