high 7.5

CVE-2022-45693 json

Jettison Out-of-bounds Write vulnerability

published 2022-12-13 3 y ago modified 2026-09-10 1 mo ago also GHSA-grr4-wv38-f68w , EUVD-2022-7636

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

Patch / fix

fixed in 2 distros 4

maven org.codehaus.jettison:jettison 1.5.2
jettison_project jettison 1.5.2

debian ubuntu red hat opensuse

libjettison-java Debian 14, Debian 13, Debian 12 1.5.3-1

debian advisories DEBIAN-CVE-2022-45693

libjettison-java Ubuntu 20.04 LTS 1.4.0-1ubuntu0.20.04.1
libjettison-java Ubuntu 22.04 LTS 1.4.1-1ubuntu0.22.04.1
libjettison-java Ubuntu Pro 16.04 LTS 1.2-3ubuntu0.1~esm1
libjettison-java Ubuntu Pro 18.04 LTS 1.4.0-1ubuntu0.18.04.1~esm1

ubuntu advisories UBUNTU-CVE-2022-45693

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
jenkins ocp tools 4.12 2.401.1.1686649641-3.el8
jenkins-2-plugins ocp tools 4.12 4.12.1686649756-1.el8

red hat advisories RHSA-2025:1747 RHSA-2025:1746 RHSA-2023:1043 RHSA-2023:1044 RHSA-2023:1045 RHSA-2023:3610

jettison openSUSE Tumbleweed 1.5.3-1.1

opensuse advisories openSUSE-SU-2024:12567-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45693 updated 2026-11-05 cvss 7.5

jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

Red Hat Migration Toolkit for Runtimes org.keycloak-keycloak-parent
affected: no fix available
Red Hat Decision Manager 7 jettison Red Hat Enterprise Linux 7 jettison, jettison-javadoc Red Hat Fuse 7 jettison
affected: no fix planned “Out of support scope”
Red Hat Integration Camel K 1 jettison
affected: no fix available
Red Hat JBoss Data Grid 7 jettison Red Hat JBoss Data Virtualization 6 jettison Red Hat JBoss Enterprise Application Platform 6 jettison, jboss-on jboss-on, eap6-jettison eap6-jettison, jbossas-modules-eap jbossas-modules-eap, keycloak-adapter-eap6 keycloak-adapter-eap6, keycloak-adapter-sso7_2-eap6 keycloak-adapter-sso7_2-eap6, +3 more
affected: no fix planned “Out of support scope”
Red Hat JBoss Enterprise Application Platform Expansion Pack jettison
affected: no fix available
Red Hat JBoss Fuse 6 jettison Red Hat JBoss Fuse Service Works 6 jettison Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 4 jenkins-2-plugins
affected: no fix available
Red Hat Process Automation 7 jettison Red Hat Satellite 6 jettison
affected: no fix planned “Out of support scope”

show 16 more

Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
fixed: vendor fix RHSA-2023:1047
Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.2-2, mta/mta-hub-rhel9 6.2.2-2, mta/mta-rhel8-operator 6.2.2-3, mta/mta-operator-bundle 6.2.2-5, mta/mta-pathfinder-rhel9 6.2.2-2, mta/mta-windup-addon-rhel9 6.2.2-3
fixed: vendor fix RHSA-2024:1027
Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins 4.12.1686649756-1.el8
fixed: vendor fix RHSA-2023:3610
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap
fixed: vendor fix RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap
fixed: vendor fix RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison 1.5.2-1.redhat_00002.1.el9eap
fixed: vendor fix RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, +23 more
fixed: vendor fix RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-cdi 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jaxrs 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jsapi 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-jackson-datatype-jdk8 2.10.4-2.redhat_00004.1.el7eap, +18 more
fixed: vendor fix RHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.4.9 jettison 1.5.2.redhat-00002
fixed: vendor fix RHSA-2023:0556
Red Hat Single Sign-On 7
fixed: vendor fix RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
fixed: vendor fix RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
fixed: vendor fix RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
fixed: vendor fix RHSA-2023:1045
Red Hat RHINT Camel-Springboot 3.14.5.P1
fixed: vendor fix RHSA-2023:0544
Red Hat RHPAM 7.13.1 async
fixed: vendor fix RHSA-2023:2135
Red Hat A-MQ Clients 2 jettison Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.401.1.1686649641-3.el8 Red Hat build of Quarkus jettison Red Hat Data Grid 8 jettison Red Hat Enterprise Linux 8 log4j, log4j-jcl, log4j-web, log4j-slf4j

+4 more productsfewer

Red Hat Enterprise Linux 9 log4j, log4j-jcl, log4j-slf4j Red Hat Integration Camel Quarkus 1 jettison Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el8eap, +40 more

not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-04-22)

Exploit prediction

1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/jettison-json/jettison/issues/52 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.codehaus.jettison:jettison	<1.5.2	1.5.2

Classification

Weakness

CWE-787 Out-of-bounds Write

References

github.com /jettison-json/jettison/issues/52
web, exploit, issue-tracking, third-party-advisory
debian.org /security/2023/dsa-5312
vendor-advisory, web, third-party-advisory
lists.debian.org /debian-lts-announce/2022/12/msg00045.html
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-45693
advisory
github.com /jettison-json/jettison
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary