{"id":"CVE-2022-24329","aliases":["EUVD-2022-0768","GHSA-2qp4-g3q3-f92w","UBUNTU-CVE-2022-24329"],"status":"published","title":"Improper Locking in JetBrains Kotlin","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02212,"percentile":0.82738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-667","CWE-829"],"published":"2022-02-25T14:35:03Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-stdlib","fixed_in":["1.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.5.32"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["0.0.1-test-deploy","0.0.2-test-deploy","0.10.1316","0.10.195","0.10.4","0.10.709","0.10.770","0.11.91","0.11.91.1","0.11.91.2","0.11.91.4","0.12.1218","0.12.1230","0.12.200","0.12.213","0.12.412","0.12.613","0.13.1513","0.13.1514","0.13.1516","0.14.449","0.14.451","0.5.1131","0.5.998","0.6.1070","0.6.1315","0.6.1411","0.6.1507","0.6.1590","0.6.1603","0.6.1617","0.6.1658","0.6.1670","0.6.1673","0.6.179","0.6.1910","0.6.22","0.6.2451","0.6.2517","0.6.31","0.6.317","0.6.350","0.6.594","0.6.602","0.6.69","0.6.786","0.6.800","0.6.912","0.7.1090","0.7.115","0.7.1217","0.7.191","0.7.258","0.7.270","0.7.271","0.7.5","0.7.802","0.7.852","0.7.86","0.7.895","0.8.11","0.8.1527","0.8.484","0.8.679","0.9.0-native","0.9.1-native","0.9.206","0.9.66","0.9.976","1.0.0","1.0.0-beta-1038","1.0.0-beta-1103","1.0.0-beta-2417","1.0.0-beta-2422","1.0.0-beta-2423","1.0.0-beta-3593","1.0.0-beta-3594","1.0.0-beta-3595","1.0.0-beta-4583","1.0.0-beta-4584","1.0.0-beta-4589","1.0.0-rc-1036","1.0.1","1.0.1-1","1.0.1-2","1.0.2","1.0.2-1","1.0.3","1.0.4","1.0.5","1.0.5-2","1.0.5-3","1.0.6","1.0.7","1.1.0","1.1.1","1.1.2","1.1.2-2","1.1.2-3","1.1.2-4","1.1.2-5","1.1.3","1.1.3-2","1.1.4","1.1.4-2","1.1.4-3","1.1.50","1.1.51","1.1.60","1.1.61","1.2.0","1.2.10","1.2.20","1.2.21","1.2.30","1.2.31","1.2.40","1.2.41","1.2.50","1.2.51","1.2.60","1.2.61","1.2.70","1.2.71","1.3.0","1.3.0-rc-190","1.3.0-rc-198","1.3.10","1.3.11","1.3.20","1.3.21","1.3.30","1.3.31","1.3.40","1.3.41","1.3.50","1.3.60","1.3.61","1.3.70","1.3.71","1.3.72","1.4.0","1.4.0-rc","1.4.10","1.4.20","1.4.20-M1","1.4.20-M2","1.4.20-RC","1.4.21","1.4.21-2","1.4.30","1.4.30-M1","1.4.30-RC","1.4.31","1.4.32","1.5.0","1.5.0-M1","1.5.0-M2","1.5.0-RC","1.5.10","1.5.20","1.5.20-M1","1.5.20-RC","1.5.21","1.5.30","1.5.30-M1","1.5.30-RC","1.5.31","1.5.32","1.6.0-M1","1.6.0-RC","1.6.0-RC2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+~1.0.1+~0.11.12-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-1build5","1.3.31+ds1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-2","1.3.31+ds1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-3ubuntu1","1.3.31+ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.31+ds1-3","1.3.31+ds1-3ubuntu1"]}],"products":[{"vendor":"jetbrains","product":"kotlin"},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function"},{"vendor":"oracle","product":"communications_pricing_design_center"}],"references":[{"url":"https://blog.jetbrains.com","tags":["x_refsource_MISC","x_transferred","Product","article","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","article","report"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24329","tags":["advisory"]},{"url":"https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2qp4-g3q3-f92w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24329.json","tags":["advisory"]},{"url":"https://github.com/JetBrains/kotlin","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-24329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24329","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-24329","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","status":"published","published":"2022-02-25T14:35:03Z","modified":"2024-08-03T04:07:02.514Z","updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-0768","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","status":"published","published":"2022-02-25T14:35:03Z","modified":"2024-08-03T04:07:02Z","updated_at":"2026-11-03T03:25:49.559039Z"}],"ghsa":[{"id":"GHSA-2qp4-g3q3-f92w","title":"Improper Locking in JetBrains Kotlin","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","status":"published","published":"2022-02-26T00:00:43Z","modified":"2024-10-29T20:00:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-667","CWE-829"],"updated_at":"2026-11-02T14:38:14.769863Z"}],"nvd":[{"id":"CVE-2022-24329","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","status":"published","published":"2022-02-25T15:15:09.897Z","modified":"2026-06-17T04:31:37.637Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"GHSA-2qp4-g3q3-f92w","title":"Improper Locking in JetBrains Kotlin","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","status":"published","published":"2022-02-26T00:00:43Z","modified":"2026-09-10T03:49:16.774455582Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-667","CWE-829"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2022-24329","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","status":"published","published":"2022-02-25T15:15:00Z","modified":"2026-10-17T12:56:20.925548606Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-24329","description":"In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.","status":"published","published":"2022-02-25T14:35:03Z","modified":"2026-10-28T02:30:25.319608441Z","updated_at":"2026-11-02T15:44:24.428403Z"}]}}