{"containers": {"cna": {"affected": [{"product": "geotools", "vendor": "geotools", "versions": [{"status": "affected", "version": ">= 26.0, < 26.4"}, {"status": "affected", "version": ">= 25.0, < 25.6"}, {"status": "affected", "version": "< 24.6"}]}], "descriptions": [{"lang": "en", "value": "GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-13T20:55:12", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49"}], "source": {"advisory": "GHSA-jvh2-668r-g75x", "discovery": "UNKNOWN"}, "title": "Unchecked JNDI lookups in GeoTools", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24818", "STATE": "PUBLIC", "TITLE": "Unchecked JNDI lookups in GeoTools"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "geotools", "version": {"version_data": [{"version_value": ">= 26.0, < 26.4"}, {"version_value": ">= 25.0, < 25.6"}, {"version_value": "< 24.6"}]}}]}, "vendor_name": "geotools"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20: Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x", "refsource": "CONFIRM", "url": "https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x"}, {"name": "https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49", "refsource": "MISC", "url": "https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49"}]}, "source": {"advisory": "GHSA-jvh2-668r-g75x", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.507Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24818", "datePublished": "2022-04-13T20:55:12", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.507Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*", "matchCriteriaId": "F68492E7-1B2A-4854-B4EE-921899EC15D9", "versionEndExcluding": "24.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEC38324-CCBF-46BE-9D58-1D821EAB22D9", "versionEndExcluding": "25.6", "versionStartIncluding": "25.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3235DAF-46D9-4ACD-8D36-467B26513BA7", "versionEndExcluding": "26.4", "versionStartIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings."}, {"lang": "es", "value": "GeoTools es una biblioteca Java de c\u00f3digo abierto que proporciona herramientas para datos geoespaciales. La biblioteca GeoTools presenta una serie de fuentes de datos que pueden llevar a cabo b\u00fasquedas JNDI no verificadas, que a su vez pueden ser usadas para llevar a cabo una deserializaci\u00f3n de clases y resultar en una ejecuci\u00f3n de c\u00f3digo arbitrario. Al igual que en el caso de Log4J, la vulnerabilidad puede desencadenarse si los nombres JNDI son proporcionados por el usuario, pero requiere un inicio de sesi\u00f3n a nivel de administrador para activarse. Las b\u00fasquedas est\u00e1n ahora restringidas en GeoTools versi\u00f3n 26.4, GeoTools versi\u00f3n 25.6 y GeoTools versi\u00f3n 24.6. Los usuarios que no puedan actualizar deben asegurarse de que cualquier aplicaci\u00f3n posterior no permita el uso de cadenas JNDI proporcionadas de forma remota"}], "id": "CVE-2022-24818", "lastModified": "2023-06-23T19:10:04.380", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-04-13T21:15:07.753", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-917"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}