Read the docs
TI-2022-12277 Aliases CVE-2022-29930GHSA-52xf-qwx9-xfxq

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value.

Priority LOW 39CWE-342Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.

Why it matters now

EPSS 0.00889 59th percentileScored 2026-11-07
Fix Fixed Ktor (JetBrains): 2.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JetBrainsKtor2.0.0; 2.0.1 to before 2.0.12.0.1Patch availableCNA
  • Ktor VendorJetBrains Affected 2.0.0; 2.0.1 to before 2.0.1 Fixed in 2.0.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:ktor:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableJetBrains
  • cpe:2.3:a:jetbrains:ktor:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·JetBrains

Remediation

  • Fix · CNA Ktor (JetBrains) Fixed in 2.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29930
  2. 2026-10-03 Alias added: GHSA-52xf-qwx9-xfxq

References

Patch 1

Advisory 1

  • TI-2023-24413 In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE CVSS 3.1CRITICAL 9.8
  • TI-2019-09527 JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the… CVSS 3.1CRITICAL 9.8
  • TI-2023-24414 In JetBrains Ktor before 2.3.5 server certificates were not verified CVSS 3.1CRITICAL 9.1
  • TI-2022-24056 In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible CVSS 3.1HIGH 7.5
  • TI-2019-07426 JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0… CVSS 3.0HIGH 8.1
  • TI-2021-19215 In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences