google/gson · Security
Deserialization of Untrusted Data in Gson
- GHSA ID
- GHSA-4jrv-ppp4-jm57
- CVE ID
- CVE-2022-25647
- Severity
- high
- Published
- Updated
- CVSS
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
- CVSS v3
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Description
The package com.google.code.gson:gson before 2.8.9 is vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to denial of service attacks.
CWEs
- CWE-502 · Deserialization of Untrusted Data
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-25647 ↗
- https://github.com/google/gson/pull/1991 ↗
- https://github.com/google/gson/pull/1991/commits ↗
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327 ↗
- https://lists.debian.org/debian-lts-announce/2022/05/msg00015.html ↗
- https://www.oracle.com/security-alerts/cpujul2022.html ↗
- https://lists.debian.org/debian-lts-announce/2022/09/msg00009.html ↗
- https://www.debian.org/security/2022/dsa-5227 ↗
- https://security.netapp.com/advisory/ntap-20220901-0009 ↗
- https://github.com/advisories/GHSA-4jrv-ppp4-jm57 ↗