# CVE-2022-24329: Improper Locking in JetBrains Kotlin

> CVE-2022-24329 (GitHub advisory GHSA-2qp4-g3q3-f92w) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.3, classed as Improper Locking (CWE-667), in org.jetbrains.kotlin:kotlin-stdlib (Maven). Affected versions: <= 1.5.32. It is fixed in 1.6.0.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2022-24329

| Field | Value |
| --- | --- |
| CVE | CVE-2022-24329 |
| GHSA | GHSA-2qp4-g3q3-f92w |
| Severity | Medium |
| CVSS 3.1 | 5.3 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N` (GitHub Advisory Database) |
| CWE | CWE-667 Improper Locking; CWE-829 Inclusion of Functionality from Untrusted Control Sphere |
| EPSS | 2.21% (higher than 81% of CVEs) |
| CISA KEV | Not listed |
| Published | 25 Feb 2022 |
| Modified | 29 Oct 2024 |

## Description

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.jetbrains.kotlin:kotlin-stdlib | Maven | `pkg:maven/org.jetbrains.kotlin/kotlin-stdlib` | <= 1.5.32 | 1.6.0 |

## Fix commits

- Release: https://github.com/jetbrains/kotlin/commit/829d1d887636689955b56beebdbb8725e908ef0f (1.6.0)

## Questions

**What is the GHSA ID for CVE-2022-24329?**

GitHub tracks CVE-2022-24329 as GHSA-2qp4-g3q3-f92w.

**What is the CVSS score of CVE-2022-24329?**

CVE-2022-24329 has a CVSS 3.1 base score of 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

**Which versions are affected by CVE-2022-24329?**

org.jetbrains.kotlin:kotlin-stdlib (Maven): <= 1.5.32.

**How do I fix CVE-2022-24329?**

Upgrade to 1.6.0 or later.

**What is the Package URL (PURL) for CVE-2022-24329?**

The affected package's PURL is pkg:maven/org.jetbrains.kotlin/kotlin-stdlib.

**Is CVE-2022-24329 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2022-24329. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 81% of CVEs.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2022-24329 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24329.json (advisory)
- https://github.com/advisories/GHSA-2qp4-g3q3-f92w (advisory)
- https://blog.jetbrains.com (article)
- https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021 (article)
- https://github.com/JetBrains/kotlin (package)
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2022-24329), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.