CVE-2022-36022: Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples
First published: Thu Nov 10 2022(Updated: )
Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use some older NLP examples that reference an old S3 bucket. The problem has been patched. Users should upgrade to snapshots as Deeplearning4J plan to publish a release with the fix at a later date. As a workaround, download a word2vec google news vector from a new source using git lfs from here.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse Deeplearning4j | <1.0.0 | |
| Eclipse Deeplearning4j | =1.0.0-beta5 | |
| Eclipse Deeplearning4j | =1.0.0-beta6 | |
| Eclipse Deeplearning4j | =1.0.0-beta7 | |
| Eclipse Deeplearning4j | =1.0.0-milestone1 | |
| Eclipse Deeplearning4j | =1.0.0-milestone1.1 | |
| Eclipse Deeplearning4j | =1.0.0-milestone2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-36022?
CVE-2022-36022 is a vulnerability in Deeplearning4J that allows unclaimed S3 buckets to be used in tests in examples.
Which versions of Deeplearning4J are affected by CVE-2022-36022?
Deeplearning4J versions up to and including 1.0.0-M2.1 are affected by CVE-2022-36022.
How does CVE-2022-36022 impact users?
CVE-2022-36022 may affect users who use the org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests packages in Deeplearning4J.
What is the severity rating of CVE-2022-36022?
CVE-2022-36022 has a severity rating of medium with a CVSS score of 5.3.
How can I fix CVE-2022-36022?
To fix CVE-2022-36022, upgrade to a version of Deeplearning4J that is not affected, such as version 1.0.0 or later.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/severity
- agent/first-publish-date
- agent/description
- agent/tags
- agent/event
- vendor/eclipse
- canonical/eclipse deeplearning4j
- version/eclipse deeplearning4j/1.0.0-beta5
- version/eclipse deeplearning4j/1.0.0-beta6
- version/eclipse deeplearning4j/1.0.0-beta7
- version/eclipse deeplearning4j/1.0.0-milestone1
- version/eclipse deeplearning4j/1.0.0-milestone1.1
- version/eclipse deeplearning4j/1.0.0-milestone2