CVE-2022-25647
HIGHCVSS 7.5/10EPSS 11.58%
Last modified
CVE-2022-25647 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.. EPSS estimates a 11.58% chance of exploitation in the next 30 days.
Description
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gson | >= 2.2.3, < 2.8.9 | |
| Debian | Debian Linux | 9.0 |
| Debian | Debian Linux | 10.0 |
| Debian | Debian Linux | 11.0 |
| Netapp | Active Iq Unified Manager | All versions |
| Oracle | Financial Services Crime And Compliance Management Studio | 8.0.8.2.0 |
| Oracle | Financial Services Crime And Compliance Management Studio | 8.0.8.3.0 |
| Oracle | Graalvm | 20.3.6 |
| Oracle | Graalvm | 21.3.2 |
| Oracle | Graalvm | 22.1.0 |
| Oracle | Retail Order Broker | 18.0 |
| Oracle | Retail Order Broker | 19.1 |
References
- https://github.com/google/gson/pull/1991Patch, Third Party Advisory
- https://github.com/google/gson/pull/1991/commitsPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/05/msg00015.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00009.htmlThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220901-0009/Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327Third Party Advisory
- https://www.debian.org/security/2022/dsa-5227Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
- https://github.com/google/gson/pull/1991Patch, Third Party Advisory
- https://github.com/google/gson/pull/1991/commitsPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/05/msg00015.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00009.htmlThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220901-0009/Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327Third Party Advisory
- https://www.debian.org/security/2022/dsa-5227Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-25647?
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
How severe is CVE-2022-25647?
CVE-2022-25647 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 11.58% probability of exploitation in the next 30 days.
How do I fix CVE-2022-25647?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25641Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2,…5.5
- CVE-2022-25642Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A …6.1
- CVE-2022-25643seatd-launch in seatd 0.6.x before 0.6.4 allows removing fil…9.8
- CVE-2022-25644All versions of package @pendo324/get-process-by-name are vu…9.8
- CVE-2022-25645All versions of package dset are vulnerable to Prototype Pol…8.1
- CVE-2022-25646All versions of package x-data-spreadsheet are vulnerable to…6.1
- CVE-2022-25648The package git before 1.11.0 are vulnerable to Command Inje…9.8
- CVE-2022-25649Multiple Improper Access Control vulnerabilities in StoreApp…8.8
- CVE-2022-2565The Simple Payment Donations & Subscriptions WordPress plugi…7.2
- CVE-2022-25650A vulnerability has been identified in Mendix Applications u…6.5
- CVE-2022-25651Memory corruption in bluetooth host due to integer overflow …9.8
- CVE-2022-25652Cryptographic issues in BSP due to improper hash verificatio…7.8
Are you affected by CVE-2022-25647?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST