CVE-2022-45136

What it actually does

Deserialization of untrusted data via a controllable JDBC URL or malicious database responses allows remote code execution when using vulnerable JDBC drivers such as MySQL.

Why it matters to the business

Organizations relying on the affected end-of-life component face risk of complete system compromise, data breach, and operational disruption with no vendor support available.

How an attack unfolds

An attacker supplies a malicious JDBC URL or compromises the database server to return crafted serialized objects; the vulnerable driver deserializes the payload during connection, executing attacker-controlled code and granting remote access.

How to fix it

Migrate immediately from the end-of-life Apache Jena SDB component to Apache Jena TDB 2 or another supported alternative; remove or isolate any remaining deployments.

How to confirm the fix worked

Confirm the component is no longer present in the environment, review all database connection configurations for external URL control, and verify migration to a supported storage backend.

Typical attack path

1. Identify an application using the vulnerable component connected to a database
2. Control or influence the JDBC connection string or database responses
3. Serve a malicious serialized object via the JDBC driver
4. Trigger deserialization to achieve code execution on the application host

How to detect it

Review application logs for unexpected JDBC connection attempts or errors, inspect process execution following database interactions, and search for serialized object artifacts in network or database traffic.

What your security team should do

• Treat as high urgency due to RCE potential and lack of patches for the EOL product
• Inventory all applications using the affected component and prioritize migration
• Block or monitor outbound JDBC connections to untrusted database endpoints
• Implement network segmentation around database-dependent services