CVE-2022-25647
High
Description
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
SeverityHigh
CVSS7.7
Exploit probability—
Product
Google Gson
PublishedMay 1, 2022
First seenMay 1, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- google gson2.8.9 or later
- com.google.code.gson:gson2.8.9 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google gson | 2.2.3 ≤ v < 2.8.9 | 2.8.9 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| netapp active_iq_unified_manager | No range specified | — |
| oracle financial_services_crime_and_compliance_management_studio | 8.0.8.2.0, 8.0.8.3.0 | — |
| oracle graalvm | 20.3.6, 21.3.2, 22.1.0 | — |
| oracle retail_order_broker | 18.0, 19.1 | — |
| com.google.code.gson:gsonMaven | v < 2.8.9 | 2.8.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.