Vulnerability in Eclipse Deeplearning4j
CVE-2022-36022
Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use some older NLP examples that reference an old S3 bucket. The problem has been patched. Users should upgrade to snapshots as Deeplearning4J plan to publish a release with the fix at a later date. As a workaround, download a word2vec google news vector from a new source using git lfs from here.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (34.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 34.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Eclipse Deeplearning4j — versions <= 1.0.0-M2.1, 1.0.0
Weakness classification (CWE)
References
- github.com/eclipse/deeplearning4j/security/advisories/GHSA-rc39-g977-687w (Third Party Advisory)
- github.com/mmihaltz/word2vec-GoogleNews-vectors (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-36022?
- CVE-2022-36022 is a medium-severity vulnerability in Eclipse Deeplearning4j, classified under CWE-344. CVSS score: 5.3/10. Published 2022-11-10.
- How severe is CVE-2022-36022?
- Medium severity. CVSS v3 base score is 5.3 out of 10.