Security Bulletin: Due to use of Apache Jena SDB, IBM Jazz Reporting Service is affected by a JDBC Deserialisation attack.

Summary Apache Jena SDB is used internally by IBM Jazz Reporting Service CVE-2022-45136. Vulnerability Details CVEID:CVE-2022-45136 DESCRIPTION: Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the...

org.aksw.jena-sparql-api:jena-sparql-api-batch (>=2.13.0-2, <=2.13.0-5), org.aksw.jena-sparql-api:jena-sparql-api-cache (>=2.13.0-2, <=2.13.0-5) +13 more potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.5.2)

org.apache.jena:jena-sdb MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - org.aksw.jena-sparql-api:jena-sparql-api-batch =2.13.0-2, =2.13.0-2, =2.13.0-2, =2.13.0-2, =2.13.0-2, =2.13.0-2...

org.apache.jena:apache-jena (2.12.0) potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.5.0)

org.apache.jena:jena-sdb MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - org.apache.jena:apache-jena 2.12.0 Source cves: CVE-2022-45136 Source advisory: OSV:GHSA-G2QW-6VRR-V6PQ...

fr.inria.wimmics:kgimport (3.3.3), org.apache.jena:apache-jena (2.11.1) +1 more potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.4.1)

org.apache.jena:jena-sdb MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - fr.inria.wimmics:kgimport 3.3.3 - org.apache.jena:apache-jena 2.11.1 - org.xenei:pa4rdf 1.2 Source cves:...

CVE-2022-45136 Apache Jena SDB allows arbitrary deserialisation via JDBC

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

CVE-2022-45136

CVE-2022-45136 affects Apache Jena SDB 3.17.0 and earlier. The vulnerability is a JDBC Deserialisation flaw that can lead to remote code execution when an attacker controls the JDBC URL or causes the database to return malicious data; the MySQL JDBC driver is specifically implicated. Jena SDB has...

CVE-2022-45136 Apache Jena SDB allows arbitrary deserialisation via JDBC

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...