GHSA-72x9-48mc-phh6

Source

https://github.com/advisories/GHSA-72x9-48mc-phh6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-72x9-48mc-phh6/GHSA-72x9-48mc-phh6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-72x9-48mc-phh6

Aliases

CVE-2022-37023

Published

2022-09-01T00:00:26Z

Modified

2023-11-01T04:59:37.163743Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data

Details

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2022-08-31T07:15:00Z",
    "github_reviewed_at": "2022-09-16T18:48:16Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.apache.geode:geode-core

Package

Name: org.apache.geode:geode-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.geode/geode-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.15.0

Affected versions

1.*

1.0.0-incubating.M2

1.0.0-incubating.M3

1.0.0-incubating

1.1.0

1.1.1

1.2.0

1.2.1

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.8.0

1.9.0

1.9.1

1.9.2

1.10.0

1.11.0

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

1.12.8

1.12.9

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.13.8

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4