GitHub Advisoryadvisory · Maven

GHSA-gj76-429m-56wc Deserialization of Untrusted Data in Apache Olingo

CRITICAL Published 2020-02-04 Modified 2021-08-19 Official page ↗
Aliases
CVE-2019-17556
Ecosystem
Maven
Packages
org.apache.olingo:odata-client-proxy
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2020-02-04

Affected packages

• Maven org.apache.olingo:odata-client-proxy: >= 4.0.0, < 4.7.0 → fixed in 4.7.0

Description

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.

Related

Alias · CVE (1)

  • CVE-2019-17556 Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References