CVE-2022-42003 is a high-severity vulnerability affecting FasterXML Jackson-data-bind, a JSON library for Java, in versions before 2.13.4.1 and 2.12.17.1. To protect against this vulnerability, it is recommended to update to the latest, unaffected versions of the software.

How do I know if I'm affected?

If you're using FasterXML Jackson-data-bind, a JSON library for Java, you might be affected by the vulnerability. This issue can cause resource exhaustion and denial of service when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. You're at risk if you're using versions before 2.13.4.1 and 2.12.17.1. Check your software version and whether the mentioned feature is enabled to determine if you're affected.

What should I do if I'm affected?

If you're affected by the vulnerability, it's important to update your software to a secure version. For Debian users, upgrade your Jackson-data-bind package to the appropriate version mentioned in the Debian security update or Debian Security Advisory. Gentoo users should follow the Gentoo security advisory to upgrade using the package manager. NetApp users can obtain software fixes through the NetApp Support website.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-42003 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity vulnerability affects FasterXML jackson-databind, a JSON library for Java, and can lead to resource exhaustion and denial of service. It was published on October 2, 2022. There is no specific due date or required action mentioned, but users are advised to update their software to a secure version to protect against this vulnerability.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-502, is related to deserialization of untrusted data in FasterXML jackson-databind, which can lead to resource exhaustion and denial of service. Update to a secure version to mitigate the risk.

For more details

CVE-2022-42003 is a high-severity vulnerability affecting FasterXML jackson-databind, which can lead to resource exhaustion and denial of service. To protect your systems, it's crucial to update to a secure version of the software. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• OSS-Fuzz Issue

• Jackson-databind Commit

• Jackson-databind GitHub Issue (1)

• Debian Security Advisory

• Debian LTS Security Update (1)

• Gentoo Security Advisory

• NetApp Product Security Advisory