CVE-2022-25845: Deserialization of Untrusted Data
A flaw was found in com.alibaba:fastjson, a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions.
Other sources
com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers.
— Red Hat
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable safeMode.
The package com.alibaba:fastjson before 1.2.83 is vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable safeMode.
— GitHub
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2022-25845?
CVE-2022-25845 is a vulnerability in the com.alibaba:fastjson package that allows for the deserialization of untrusted data, potentially leading to remote server attacks.
What is the severity of CVE-2022-25845?
CVE-2022-25845 has a severity rating of 9.8, which is considered critical.
How does CVE-2022-25845 affect the com.alibaba:fastjson package?
CVE-2022-25845 affects com.alibaba:fastjson versions before 1.2.83 and allows for the bypassing of default autoType shutdown restrictions during deserialization.
What is the workaround for CVE-2022-25845?
The recommended workaround for CVE-2022-25845 is to upgrade to version 1.2.83 of the com.alibaba:fastjson package.
Where can I find more information about CVE-2022-25845?
More information about CVE-2022-25845 can be found at the following references: [Reference 1](https://access.redhat.com/errata/RHSA-2022:5532), [Reference 2](https://access.redhat.com/security/cve/cve-2022-25845), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi?id=2100654).