Security Bulletin: Due to use of Apache Jena SDB, IBM Jazz Reporting Service is affected by a JDBC Deserialisation attack.

Summary Apache Jena SDB is used internally by IBM Jazz Reporting Service CVE-2022-45136. Vulnerability Details CVEID:CVE-2022-45136 DESCRIPTION: Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the...

Deserialization Of Untrusted Data

jena-sdb is vulnerable to deserialization of untrusted data. The vulnerability exists when the attacker is able to control the JDBC url or cause the underlying database server to return malicious data, leading to remote code execution when connected to a malicious database...

org.apache.jena:apache-jena (2.11.0) potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.4.0)

org.apache.jena:jena-sdb MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - org.apache.jena:apache-jena 2.11.0 Source cves: CVE-2022-45136 Source advisory: OSV:GHSA-G2QW-6VRR-V6PQ...

fr.inria.wimmics:kgimport (3.3.3), org.apache.jena:apache-jena (2.11.1) +1 more potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.4.1)

org.apache.jena:jena-sdb MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - fr.inria.wimmics:kgimport 3.3.3 - org.apache.jena:apache-jena 2.11.1 - org.xenei:pa4rdf 1.2 Source cves:...

org.apache.jena:apache-jena (2.11.2) potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.4.2)

org.apache.jena:jena-sdb MAVEN version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - org.apache.jena:apache-jena 2.11.2 Source cves: CVE-2022-45136 Source advisory: OSV:GHSA-G2QW-6VRR-V6PQ...

org.apache.jena:apache-jena (2.12.0) potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.5.0)

org.apache.jena:jena-sdb MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - org.apache.jena:apache-jena 2.12.0 Source cves: CVE-2022-45136 Source advisory: OSV:GHSA-G2QW-6VRR-V6PQ...

org.apache.jena:apache-jena (2.12.1), org.xenei:pa4rdf (1.3) potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.5.1)

org.apache.jena:jena-sdb MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - org.apache.jena:apache-jena 2.12.1 - org.xenei:pa4rdf 1.3 Source cves: CVE-2022-45136 Source advisory:...

org.aksw.jena-sparql-api:jena-sparql-api-batch (>=2.13.0-2, <=2.13.0-5), org.aksw.jena-sparql-api:jena-sparql-api-cache (>=2.13.0-2, <=2.13.0-5) +13 more potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (1.5.2)

org.apache.jena:jena-sdb MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jena:jena-sdb and may be impacted: - org.aksw.jena-sparql-api:jena-sparql-api-batch =2.13.0-2, =2.13.0-2, =2.13.0-2, =2.13.0-2, =2.13.0-2, =2.13.0-2...

CVE-2022-45136

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

DEBIAN-CVE-2022-45136

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

CVE-2022-45136

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

UBUNTU-CVE-2022-45136

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

Design/Logic Flaw

UNSUPPORTED WHEN ASSIGNED Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this...

PT-2022-27413 · Apache +1 · Apache Jena Tdb 2 +2

Name of the Vulnerable Software and Affected Versions: Apache Jena SDB versions 3.17.0 and earlier Description: The issue allows for a JDBC Deserialisation attack if the attacker can control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver ...

CVE-2022-45136 Apache Jena SDB allows arbitrary deserialisation via JDBC

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

CVE-2022-45136

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

CVE-2022-45136: Deserialization of Untrusted Data

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...

CVE-2022-45136

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a resu...