high 7.5

CVE-2022-45693 json

Jettison Out-of-bounds Write vulnerability

published 2022-12-13 3y ago modified 2026-09-10 last mo. also GHSA-grr4-wv38-f68w , EUVD-2022-7636

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

Patch / fix

fixed in 2 distros 4

maven org.codehaus.jettison:jettison 1.5.2
jettison_project jettison 1.5.2

debian ubuntu red hat opensuse

libjettison-java Debian 14, Debian 13, Debian 12 1.5.3-1

debian advisories DEBIAN-CVE-2022-45693

libjettison-java Ubuntu 20.04 LTS 1.4.0-1ubuntu0.20.04.1
libjettison-java Ubuntu 22.04 LTS 1.4.1-1ubuntu0.22.04.1
libjettison-java Ubuntu Pro 16.04 LTS 1.2-3ubuntu0.1~esm1
libjettison-java Ubuntu Pro 18.04 LTS 1.4.0-1ubuntu0.18.04.1~esm1

ubuntu advisories UBUNTU-CVE-2022-45693

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
jenkins ocp tools 4.12 2.401.1.1686649641-3.el8
jenkins-2-plugins ocp tools 4.12 4.12.1686649756-1.el8

red hat advisories RHSA-2025:1747 RHSA-2025:1746 RHSA-2023:1043 RHSA-2023:1044 RHSA-2023:1045 RHSA-2023:3610

jettison openSUSE Tumbleweed 1.5.3-1.1

opensuse advisories openSUSE-SU-2024:12567-1

Is CVE-2022-45693 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45693 updated 2026-11-05 cvss 7.5

jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

Red Hat Migration Toolkit for Runtimes org.keycloak-keycloak-parent
affected: no fix available
Red Hat Decision Manager 7 jettison Red Hat Enterprise Linux 7 jettison, jettison-javadoc Red Hat Fuse 7 jettison
affected: no fix planned “Out of support scope”
Red Hat Integration Camel K 1 jettison
affected: no fix available
Red Hat JBoss Data Grid 7 jettison Red Hat JBoss Data Virtualization 6 jettison Red Hat JBoss Enterprise Application Platform 6 jettison, jboss-on jboss-on, eap6-jettison eap6-jettison, jbossas-modules-eap jbossas-modules-eap, keycloak-adapter-eap6 keycloak-adapter-eap6, keycloak-adapter-sso7_2-eap6 keycloak-adapter-sso7_2-eap6, +3 more
affected: no fix planned “Out of support scope”
Red Hat JBoss Enterprise Application Platform Expansion Pack jettison
affected: no fix available
Red Hat JBoss Fuse 6 jettison Red Hat JBoss Fuse Service Works 6 jettison Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 4 jenkins-2-plugins
affected: no fix available
Red Hat Process Automation 7 jettison Red Hat Satellite 6 jettison
affected: no fix planned “Out of support scope”

show 16 more

Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
fixed: vendor fix RHSA-2023:1047
Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.2-2, mta/mta-hub-rhel9 6.2.2-2, mta/mta-rhel8-operator 6.2.2-3, mta/mta-operator-bundle 6.2.2-5, mta/mta-pathfinder-rhel9 6.2.2-2, mta/mta-windup-addon-rhel9 6.2.2-3
fixed: vendor fix RHSA-2024:1027
Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins 4.12.1686649756-1.el8
fixed: vendor fix RHSA-2023:3610
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap
fixed: vendor fix RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap
fixed: vendor fix RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison 1.5.2-1.redhat_00002.1.el9eap
fixed: vendor fix RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, +23 more
fixed: vendor fix RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-cdi 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jaxrs 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-resteasy-jsapi 3.11.6-1.Final_redhat_00001.1.el7eap, eap7-jackson-datatype-jdk8 2.10.4-2.redhat_00004.1.el7eap, +18 more
fixed: vendor fix RHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.4.9 jettison 1.5.2.redhat-00002
fixed: vendor fix RHSA-2023:0556
Red Hat Single Sign-On 7
fixed: vendor fix RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
fixed: vendor fix RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
fixed: vendor fix RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
fixed: vendor fix RHSA-2023:1045
Red Hat RHINT Camel-Springboot 3.14.5.P1
fixed: vendor fix RHSA-2023:0544
Red Hat RHPAM 7.13.1 async
fixed: vendor fix RHSA-2023:2135
Red Hat A-MQ Clients 2 jettison Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.401.1.1686649641-3.el8 Red Hat build of Quarkus jettison Red Hat Data Grid 8 jettison Red Hat Enterprise Linux 8 log4j, log4j-jcl, log4j-web, log4j-slf4j

+4 more productsfewer

Red Hat Enterprise Linux 9 log4j, log4j-jcl, log4j-slf4j Red Hat Integration Camel Quarkus 1 jettison Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el7eap, +42 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el8eap, +40 more

not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: last yr. (2025-04-22)

Exploit prediction

1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/jettison-json/jettison/issues/52 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.codehaus.jettison:jettison	<1.5.2	1.5.2

Classification

Weakness

CWE-787 Out-of-bounds Write

References

github.com /jettison-json/jettison/issues/52
web, exploit, issue-tracking, third-party-advisory
debian.org /security/2023/dsa-5312
vendor-advisory, web, third-party-advisory
lists.debian.org /debian-lts-announce/2022/12/msg00045.html
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-45693
advisory
github.com /jettison-json/jettison
package

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed