CVE-2022-36022

Katalog CVE

CVSS 5.3 · Medium EPSS 0,42%

Kerentanan Use of Invariant Value in Dynamically Changing Context pada eclipse deeplearning4j. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use some older NLP examples that reference an old S3 bucket. The problem has been patched. Users should upgrade to snapshots as Deeplearning4J plan to publish a release with the fix at a later date. As a workaround, download a word2vec google news vector from a new source using git lfs from here.

Rincian

Terbit di NVD

10 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-344: Use of Invariant Value in Dynamically Changing Context
CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/eclipse/deeplearning4j/security/advisories/GHSA-rc39-g977-687w advisory pihak ketiga
• https://github.com/mmihaltz/word2vec-GoogleNews-vectors advisory pihak ketiga