GHSA-3xq2-w6j4-c99r

Source

https://github.com/advisories/GHSA-3xq2-w6j4-c99r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3xq2-w6j4-c99r

Aliases

CVE-2024-22399

Published

2024-09-16T14:37:28Z

Modified

2024-11-18T16:27:12Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Apache Seata Deserialization of Untrusted Data vulnerability

Details

Deserialization of Untrusted Data vulnerability in Apache Seata.

When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol.

This issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0.

Users are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.

Database specific

{
    "nvd_published_at": "2024-09-16T12:15:02Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-16T20:18:41Z"
}

References

Affected packages

Maven / org.apache.seata:seata-core

Package

Name: org.apache.seata:seata-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.seata/seata-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.1.0

Affected versions

2.*

2.0.0

Maven / org.apache.seata:seata-core

Package

Name: org.apache.seata:seata-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.seata/seata-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.8.1