GitHub Advisoryadvisory · Maven

GHSA-fjq5-5j5f-mvxh Deserialization of Untrusted Data in Apache commons collections

CRITICAL Published 2022-05-13 Modified 2022-11-03 Official page ↗
Aliases
CVE-2015-7501
Ecosystem
Maven
Packages
commons-collections:commons-collections, org.apache.commons:commons-collections4, org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections, net.sourceforge.collections:collections-generic, org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-11-03

Affected packages

• Maven commons-collections:commons-collections: < 3.2.2 → fixed in 3.2.2 • Maven org.apache.commons:commons-collections4: < 4.1 → fixed in 4.1 • Maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections: < 3.2.2 (no fix yet) • Maven net.sourceforge.collections:collections-generic: 4.01 (no fix yet) • Maven org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic: < 4.02 (no fix yet)

Description

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.

Related

Alias · CVE (1)

  • CVE-2015-7501 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References