GHSA-95m2-p98f-24r5

ghsaUSosv

Apache Geode unsafe deserialization of application objects

view advisory published 2022-05-14Licence: CC-BY-4.0

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-15693US	high7.5	2.47% (84th)	—	2018-02-27
In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized…

references

External citations — patches, advisories, analysis.

https://github.com/apache/geode/pull/1166WEB
https://issues.apache.org/jira/browse/GEODE-3923WEB
https://lists.apache.org/thread.html/cc3ec1d06062f54fdaa0357874c1d148fc54bb955f2d2df4ca328a3d@%3Cuser.geode.apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-15693ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan