GitHub Advisoryadvisory · Maven

GHSA-95m2-p98f-24r5 Apache Geode unsafe deserialization of application objects

HIGH Published 2022-05-14 Modified 2022-11-08 Official page ↗
Aliases
CVE-2017-15693
Ecosystem
Maven
Packages
org.apache.geode:geode-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-11-08

Affected packages

• Maven org.apache.geode:geode-core: >= 1.0.0, < 1.4.0 → fixed in 1.4.0

Description

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.

Related

Alias · CVE (1)

  • CVE-2017-15693 In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References