What is CVE-2022-42004?
CVE-2022-42004 is a high-severity vulnerability affecting systems using the FasterXML jackson-databind library before version 2.13.4. This vulnerability can lead to resource exhaustion due to a lack of checks in the BeanDeserializer.\_deserializeFromArray function, which prevents the use of deeply nested arrays. Systems using the affected versions of the library, particularly those with certain customized choices for deserialization, are at risk.
Who is impacted by this?
Other affected systems include Quarkus up to version 2.13.0, Debian Linux 10.0 and 11.0, and NetApp OnCommand Workflow Automation. In summary, the impacted versions are FasterXML jackson-databind up to 2.12.7.1 and from 2.13.0 to 2.13.4, Quarkus up to 2.13.0, Debian Linux 10.0 and 11.0, and all versions of NetApp OnCommand Workflow Automation.
What should I do if I’m affected?
If you're affected by the CVE-2022-42004 vulnerability, it's important to take action to protect your systems. Here's a simple guide to help you:
Upgrade to the latest version of FasterXML jackson-databind (2.13.4 or later).
For Quarkus users, update to version 2.13.0 or later.
Debian Linux users should apply the jackson-databind security update for Debian 10 and 11.
NetApp OnCommand Workflow Automation users should consult NetApp for guidance on addressing the vulnerability.
Is this in CISA’s Known Exploited Vulnerabilities Catalog?
The CVE-2022-42004 vulnerability, also known as FasterXML jackson-databind before 2.13.4, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on October 2, 2022, and requires users to update their systems to mitigate the risk.
Weakness Enumeration
The weakness enumeration for this vulnerability is categorized as CWE-502, which involves deserialization of untrusted data.
Learn More
For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.
