CVE-2022-45136: JDBC Deserialisation in Apache Jena SDB

[Rob Vesse <rv...@apache.org>]

Severity: low

Description:

** UNSUPPORTED WHEN ASSIGNED ** Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data.  The mySQL JDBC driver in particular is known to be vulnerable to this class of attack.  As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server.

Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.

Mitigation:

Apache Jena SDB has been EOL since December 2020, users should migrate to alternative options from the Apache Jena project e.g. Apache Jena TDB 2 or from 3rd party vendors.


Users utilising Apache Jena SDB with mySQL should ensure they explicitly set autoDeserialize=false on their JDBC connection strings.  It is also recommended that users ensure that any ability to set the JDBC connection string is limited to appropriate users.

Credit:

Apache Jena would like to thank Crilwa & LaNyer640 for reporting this issue

FW: CVE-2022-45136: JDBC Deserialisation in Apache Jena SDB

["rvesse@dotnetrdf.org" <rv...@dotnetrdf.org>]

FYI

The Jena PMC received a report of a security vulnerability in Jena SDB and has issued a CVE as a result which you will find forwarded below.

SDB has been End of Life (EOL) since December 2020 and is no longer supported by the project.  Any users who are still using SDB should migrate to alternative options e.g., TDB 2, or consider the mitigations detailed in the CVE.

Note that we did also review the Jena JDBC code which is currently supported by the project but did not find it to be vulnerable to this particular class of attack.

As a relatively small developer community the project only supports a single release version at any one time, and we do not have the resources to backport fixes (security or otherwise) to older releases.  Therefore, we’d remind our users that we always recommend using the latest Jena release available

Regards,

Rob Vesse

From: Rob Vesse <rv...@apache.org>
Date: Monday, 14 November 2022 at 15:40
To: announce@apache.org <an...@apache.org>, dev@jena.apache.org <de...@jena.apache.org>
Subject: CVE-2022-45136: JDBC Deserialisation in Apache Jena SDB
Severity: low

Description:

** UNSUPPORTED WHEN ASSIGNED ** Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data.  The mySQL JDBC driver in particular is known to be vulnerable to this class of attack.  As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server.

Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.

Mitigation:

Apache Jena SDB has been EOL since December 2020, users should migrate to alternative options from the Apache Jena project e.g. Apache Jena TDB 2 or from 3rd party vendors.


Users utilising Apache Jena SDB with mySQL should ensure they explicitly set autoDeserialize=false on their JDBC connection strings.  It is also recommended that users ensure that any ability to set the JDBC connection string is limited to appropriate users.

Credit:

Apache Jena would like to thank Crilwa & LaNyer640 for reporting this issue