CVE-2022-37023

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-37023

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37023.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-37023

Aliases

GHSA-72x9-48mc-phh6

Published

2022-08-31T07:00:16Z

Modified

2026-08-12T13:33:05.554611Z

Summary

Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11

Details

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Apache Geode"
                },
                {
                    "fixed": "1.15.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37023.json"
}

References

Affected packages

Git / github.com/apache/geode

Affected ranges

Type

GIT

Repo

https://github.com/apache/geode

Events

Introduced

Fixed

1869f2c06681bb73de727d2080d76c6215db9fb9

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.15.0"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:*"
}

Affected versions

Other

develop/highwater

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37023.json"

vanir_signatures

[
    {
        "target": {
            "file": "geode-core/src/test/java/org/apache/geode/internal/cache/tier/sockets/CacheClientProxyTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/apache/geode/commit/1869f2c06681bb73de727d2080d76c6215db9fb9",
        "id": "CVE-2022-37023-809662cb",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "271565698906081870400169871511662208430",
                "176187584659808302530788165325360213355",
                "134880645845953282268972577247585880031",
                "53295455689425563555996461759800583693",
                "70083092266538896607488590401427580807",
                "289021059350922040194240575560381792757",
                "10829721629913145967682247146006937839",
                "305238111899125501357639011755052031703",
                "93335574219089873899986001117433296606",
                "314749251526121229644009105875443066679",
                "164254472352684605065835893787591616778",
                "310113726972266865595363195125320584944",
                "329861190717333577342179465029766201288",
                "7284826531753941901750520790015254528",
                "69758159662841269769156527668657038799",
                "114393473920070319626796743782660078873",
                "116252813271263944326105403300875878227",
                "275776104964228786121551553639020523464",
                "268677713687836665472361218880504497278",
                "291620291836338604326870964666082246575",
                "304876704896918746566785673531662587337",
                "892111163148490529540875392021719412",
                "284626310180379447834987912419466098288"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/CacheClientProxy.java"
        },
        "deprecated": false,
        "source": "https://github.com/apache/geode/commit/1869f2c06681bb73de727d2080d76c6215db9fb9",
        "id": "CVE-2022-37023-84bd298c",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "279118738397569944925485559297762383710",
                "65322130819880844940466556451331768114",
                "277682453534267293812759125465126622376",
                "301472015557760709901877389848514072764",
                "319421240591323641868920876121877197410",
                "238359394992625475952054164253364297180",
                "4410955819757281567268618184541616251",
                "223043664404684175555379802953565586640"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "before",
            "file": "geode-core/src/test/java/org/apache/geode/internal/cache/tier/sockets/CacheClientProxyTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/apache/geode/commit/1869f2c06681bb73de727d2080d76c6215db9fb9",
        "id": "CVE-2022-37023-97ffb935",
        "signature_version": "v1",
        "digest": {
            "length": 1321.0,
            "function_hash": "137852228223487124481135004770762797359"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "notifyReAuthentication",
            "file": "geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/CacheClientProxy.java"
        },
        "deprecated": false,
        "source": "https://github.com/apache/geode/commit/1869f2c06681bb73de727d2080d76c6215db9fb9",
        "id": "CVE-2022-37023-98869495",
        "signature_version": "v1",
        "digest": {
            "length": 105.0,
            "function_hash": "327511076890806405506015692481445654339"
        },
        "signature_type": "Function"
    }
]

vanir_signatures_modified

"2026-08-12T13:33:05Z"