CVE-2022-24818: Unchecked JNDI lookups in GeoTools
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24818?
CVE-2022-24818 has a critical severity level due to the potential for arbitrary code execution.
How do I fix CVE-2022-24818?
To fix CVE-2022-24818, update GeoTools to version 24.6 or later, or upgrade to a version above 25.6 or 26.4.
What are the potential impacts of CVE-2022-24818?
The potential impacts of CVE-2022-24818 include unauthorized remote code execution and system compromise.
Which versions of GeoTools are affected by CVE-2022-24818?
GeoTools versions prior to 24.6, and versions between 25.0 and 25.6, and between 26.0 and 26.4 are affected by CVE-2022-24818.
Is CVE-2022-24818 related to JNDI lookups?
Yes, CVE-2022-24818 is related to unchecked JNDI lookups that can lead to class deserialization and arbitrary code execution.