CVE-2022-36022 - CVE House
Back to Database
Status published Medium CVE-2022-36022

Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples

Vulnerability Description

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use some older NLP examples that reference an old S3 bucket. The problem has been patched. Users should upgrade to snapshots as Deeplearning4J plan to publish a release with the fix at a later date. As a workaround, download a word2vec google news vector from a new source using git lfs from here.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36022

Credits & Attribution

No credits recorded in the NVD database.

References

More from eclipse

View All →
CVE-2023-41900
Jetty's OpenId Revoked authentication allows one request
Low 3.5
CVE-2023-40167
Jetty accepts "+" prefixed value in Content-Length
Medium 5.3
CVE-2023-36479
Jetty vulnerable to errant command quoting in CGI Servlet
Low 3.5
CVE-2023-36478
HTTP/2 HPACK integer overflow and buffer allocation
High 7.5
CVE-2023-26049
Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Low 2.4

Affected Vendor

Affected Software

deeplearning4j
Vulnerable Versions:
<= 1.0.0-M2.1

Timeline

Official Publish: November 10th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-344

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.