CVE-2022-25647

Deserialization of Untrusted Data

Published May 1, 2022 CVSS 3.1 · 7.7 High EPSS 12.2% KEV · Not listed
Description
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-3001-1 libgoogle-gson-java security update
Debian DLA Debian DLA DLA-3100-1 libgoogle-gson-java security update
Debian DSA Debian DSA DSA-5227-1 libgoogle-gson-java security update
EUVD EUVD EUVD-2022-2402 The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
Github GHSA Github GHSA GHSA-4jrv-ppp4-jm57 Deserialization of Untrusted Data in Gson
Ubuntu USN Ubuntu USN USN-6692-1 Gson vulnerability
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus