Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use some older NLP examples that reference an old S3 bucket. The problem has been patched. Users should upgrade to snapshots as Deeplearning4J plan to publish a release with the fix at a later date. As a workaround, download a word2vec google news vector from a new source using git lfs from here.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | deeplearning4j | up to 1.0.0-M2.1 | — | No fix listed | CNA |
| — | org.deeplearning4j:platform-tests (Maven) | up to 1.0.0-M2.1 | — | No fix listed | GHSA-rc39-g977-687w |
| — | org.deeplearning4j:dl4j-examples (Maven) | up to 1.0.0-M2.1 | — | No fix listed | GHSA-rc39-g977-687w |
- deeplearning4j VendorEclipse Foundation Affected up to 1.0.0-M2.1 Fixed in — No fix listed CNA
- org.deeplearning4j:platform-tests (Maven) Vendor— Affected up to 1.0.0-M2.1 Fixed in — No fix listed GHSA-rc39-g977-687w
- org.deeplearning4j:dl4j-examples (Maven) Vendor— Affected up to 1.0.0-M2.1 Fixed in — No fix listed GHSA-rc39-g977-687w
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:deeplearning4j:*:*:*:*:*:*:*:* | before 1.0.0 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:deeplearning4j:1.0.0:beta5:*:*:*:*:*:* | 1.0.0 beta5 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:deeplearning4j:1.0.0:beta6:*:*:*:*:*:* | 1.0.0 beta6 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:deeplearning4j:1.0.0:beta7:*:*:*:*:*:* | 1.0.0 beta7 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:deeplearning4j:1.0.0:milestone1:*:*:*:*:*:* | 1.0.0 milestone1 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:deeplearning4j:1.0.0:milestone1.1:*:*:*:*:*:* | 1.0.0 milestone1.1 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:deeplearning4j:1.0.0:milestone2:*:*:*:*:*:* | 1.0.0 milestone2 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:deeplearning4j:*:*:*:*:*:*:*:* Versions before 1.0.0 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:deeplearning4j:1.0.0:beta5:*:*:*:*:*:* Versions 1.0.0 beta5 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:deeplearning4j:1.0.0:beta6:*:*:*:*:*:* Versions 1.0.0 beta6 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:deeplearning4j:1.0.0:beta7:*:*:*:*:*:* Versions 1.0.0 beta7 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:deeplearning4j:1.0.0:milestone1:*:*:*:*:*:* Versions 1.0.0 milestone1 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:deeplearning4j:1.0.0:milestone1.1:*:*:*:*:*:* Versions 1.0.0 milestone1.1 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:deeplearning4j:1.0.0:milestone2:*:*:*:*:*:* Versions 1.0.0 milestone2 Vulnerable ·Eclipse Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-36022
- 2026-10-03 Alias added: GHSA-rc39-g977-687w
References
Advisory 3
Sources
- CVE-2022-36022 · CVE Program
- CVE-2022-36022 · NVD
- FIRST EPSS
- GHSA-rc39-g977-687w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences