GitHub Advisoryadvisory · Maven

GHSA-6hgm-866r-3cjv Insecure Deserialization in Apache Commons Collection

HIGH Published 2020-06-15 Modified 2023-05-31 Official page ↗
Aliases
CVE-2015-6420
Ecosystem
Maven
Packages
org.apache.commons:commons-collections4, commons-collections:commons-collections, net.sourceforge.collections:collections-generic, org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic, org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections
Severity
High
Weaknesses
CWE-502
Reviewed
2020-06-11

Affected packages

• Maven org.apache.commons:commons-collections4: < 4.1 → fixed in 4.1 • Maven commons-collections:commons-collections: < 3.2.2 → fixed in 3.2.2 • Maven net.sourceforge.collections:collections-generic: <= 4.0.1 (no fix yet) • Maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic: <= 4.01 (no fix yet) • Maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections: <= 3.2.1 (no fix yet)

Description

Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.

Related

Alias · CVE (1)

  • CVE-2015-6420 Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application,… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References