Loading vulnerability…
Gson writeReplace() Deserialization Denial of Service
CVE-2022-25647 is an unsafe deserialization vulnerability in com.google.code.gson:gson versions before 2.8.9. Gson internal classes can invoke the writeReplace() method during deserialization of untrusted data. Crafted serialized input can abuse this behavior to trigger a denial-of-service condition.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to supply malicious data to an affected Gson deserialization path can cause denial of service. In affected F5 BIG-IP iAppsLX and BIG-IQ iControl REST deployments, an authenticated remote attacker can disrupt the control plane and new client connections; the data plane is not affected.
If you can’t patch tonight, do this now.
Restrict access to interfaces and application functions that accept data processed by Gson to trusted users and networks. For affected BIG-IP and BIG-IQ deployments, restrict management-plane, Configuration utility, and iControl REST access using port lockdown, firewall rules, or packet filtering, and remove access for untrusted users.
Patch, then assume compromise.
Upgrade com.google.code.gson:gson to version 2.8.9 or later. Apply the vendor-supported fixed release for products that bundle Gson, including applicable platform and appliance updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.