GitHub Advisoryadvisory · Maven

GHSA-w395-hpq9-7xwr Apache Geode unsafe deserialization in TcpServer

CRITICAL Published 2022-05-14 Modified 2022-11-08 Official page ↗
Aliases
CVE-2017-15692
Ecosystem
Maven
Packages
org.apache.geode:geode-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-11-08

Affected packages

• Maven org.apache.geode:geode-core: >= 1.0.0, < 1.4.0 → fixed in 1.4.0

Description

In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath.

Related

Alias · CVE (1)

  • CVE-2017-15692 In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References