GitHub Advisoryadvisory · Maven

GHSA-jv65-pf7v-f7p8 Deserialization of Untrusted Data in Hazelcast

HIGH Published 2022-05-24 Modified 2022-07-06 Official page ↗
Aliases
CVE-2016-10750
Ecosystem
Maven
Packages
com.hazelcast:hazelcast
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-07-06

Affected packages

• Maven com.hazelcast:hazelcast: < 3.11 → fixed in 3.11

Description

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.

Related

Alias · CVE (1)

  • CVE-2016-10750 In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References