CVE-2022-45693: Buffer Overflow

Published Dec 13, 2022
·
Updated

A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.

Other sources

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

Jettison is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker could exploit this vulnerability to cause a denial of service.

— IBM

Affected Software

18 affected componentsFixes available
redhat/jenkins<2-plugins-0:4.12.1686649756-1.el8
2-plugins-0:4.12.1686649756-1.el8
redhat/eap7-jettison<0:1.5.2-1.redhat_00002.1.el8ea
0:1.5.2-1.redhat_00002.1.el8ea
redhat/eap7-jettison<0:1.5.2-1.redhat_00002.1.el9ea
0:1.5.2-1.redhat_00002.1.el9ea
redhat/eap7-jettison<0:1.5.2-1.redhat_00002.1.el7ea
0:1.5.2-1.redhat_00002.1.el7ea
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el7
0:18.0.6-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el8
0:18.0.6-1.redhat_00001.1.el8
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el9
0:18.0.6-1.redhat_00001.1.el9
debian/libjettison-java<=1.4.0-1
1.5.3-1~deb10u11.5.3-1~deb11u11.5.3-11.5.4-1
IBM Data Virtualization on Cloud Pak for Data<=3.0
IBM Watson Query on Cloud Pak for Data<=2.2
IBM Watson Query on Cloud Pak for Data<=2.1
IBM Watson Query on Cloud Pak for Data<=2.0
IBM Data Virtualization on Cloud Pak for Data<=1.8
IBM Data Virtualization on Cloud Pak for Data<=1.7
redhat/jettison<1.5.2
1.5.2
Jettison Project Jettison<1.5.2
Debian Debian Linux=10.0
Debian Debian Linux=11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.12.1686649756-1.el8
  2. Upgrade

    Upgrade redhat/eap7-jettison to a version that resolves this vulnerability.

    Fixed in 0:1.5.2-1.redhat_00002.1.el8ea
  3. Upgrade

    Upgrade redhat/eap7-jettison to a version that resolves this vulnerability.

    Fixed in 0:1.5.2-1.redhat_00002.1.el9ea
  4. Upgrade

    Upgrade redhat/eap7-jettison to a version that resolves this vulnerability.

    Fixed in 0:1.5.2-1.redhat_00002.1.el7ea
  5. Upgrade

    Upgrade redhat/rh-sso7-keycloak to a version that resolves this vulnerability.

    Fixed in 0:18.0.6-1.redhat_00001.1.el7
  6. Upgrade

    Upgrade redhat/rh-sso7-keycloak to a version that resolves this vulnerability.

    Fixed in 0:18.0.6-1.redhat_00001.1.el8
  7. Upgrade

    Upgrade redhat/rh-sso7-keycloak to a version that resolves this vulnerability.

    Fixed in 0:18.0.6-1.redhat_00001.1.el9
  8. Upgrade

    Upgrade debian/libjettison-java to a version that resolves this vulnerability.

    Fixed in 1.5.3-1~deb10u1Fixed in 1.5.3-1~deb11u1Fixed in 1.5.3-1Fixed in 1.5.4-1
  9. Upgrade

    Upgrade redhat/jettison to a version that resolves this vulnerability.

    Fixed in 1.5.2

Event History

Dec 13, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Dec 23, 2022
Data Sourced
via Red Hat·04:41 AM
DescriptionSeverityAffected Software
Aug 15, 2025
Data Sourced
via IBM·03:29 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2022-45693?

CVE-2022-45693 is a vulnerability in Jettison that allows a remote attacker to cause a denial of service through a stack-based buffer overflow.

2

How does CVE-2022-45693 impact Jettison?

CVE-2022-45693 can lead to a denial of service in Jettison by exploiting a stack-based buffer overflow vulnerability.

3

What is the severity level of CVE-2022-45693?

CVE-2022-45693 has a severity level of high.

4

Which versions of Jettison are affected by CVE-2022-45693?

Versions 1.5.2 and below of Jettison are affected by CVE-2022-45693.

5

How can I fix CVE-2022-45693?

To fix CVE-2022-45693, update Jettison to a version higher than 1.5.2.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203