Deserialization Of Untrusted Data

2022-11-1512:16:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jena-sdb

deserialization

untrusted data

jdbc url

remote code execution

malicious database

0.046 Low

EPSS

Percentile

92.6%

JSON

jena-sdb is vulnerable to deserialization of untrusted data. The vulnerability exists when the attacker is able to control the JDBC url or cause the underlying database server to return malicious data, leading to remote code execution when connected to a malicious database.

CPENameOperatorVersion
apache jena - sdb (sql based triple store)le3.17.0
apache jena - sdb (sql based triple store)le3.17.0

CPE	Name	Operator	Version
	apache jena - sdb (sql based triple store)	le	3.17.0
	apache jena - sdb (sql based triple store)	le	3.17.0

References

www.openwall.com/lists/oss-security/2022/11/14/5

github.com/advisories/GHSA-g2qw-6vrr-v6pq

lists.apache.org/thread/mc77cdl5stgjtjoldk467gdf756qjt31