GHSA-jv65-pf7v-f7p8

Source

https://github.com/advisories/GHSA-jv65-pf7v-f7p8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jv65-pf7v-f7p8/GHSA-jv65-pf7v-f7p8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jv65-pf7v-f7p8

Aliases

CVE-2016-10750

Published

2022-05-24T16:46:09Z

Modified

2023-11-08T03:58:21.515204Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Deserialization of Untrusted Data in Hazelcast

Details

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.

Database specific

{
    "nvd_published_at": "2019-05-22T14:29:00Z",
    "github_reviewed_at": "2022-07-06T20:03:09Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Maven / com.hazelcast:hazelcast

Package

Name: com.hazelcast:hazelcast; View open source insights on deps.dev
Purl: pkg:maven/com.hazelcast/hazelcast

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.11

Affected versions

1.*

1.5

1.5.1

1.5.2

1.5.3

1.6-RC1

1.6

1.7-RC1

1.7-RC2

1.7-RC3

1.7-RC4

1.7

1.7.1

1.8

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.9

1.9.1-RC2

1.9.1

1.9.2

1.9.2.1

1.9.2.2

1.9.2.3

1.9.3-RC

1.9.3

1.9.3.1

1.9.3.2

1.9.3.3

1.9.3.4

1.9.4-RC

1.9.4-RC1

1.9.4

1.9.4.1

1.9.4.2

1.9.4.3

1.9.4.4

1.9.4.5

1.9.4.6

1.9.4.8

2.*

2.0-RC1

2.0-RC2

2.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1

2.1.1

2.1.2

2.1.3

2.2

2.3

2.3.1

2.4

2.4.1

2.5

2.5.1

2.6

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.6.9

2.6.10

3.*

3.0-RC1

3.0-RC2

3.0

3.0.1

3.0.2

3.0.3

3.1

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.2-RC1

3.2-RC2

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.3-RC1

3.3-RC2

3.3-RC3

3.3

3.3-EA

3.3-EA2

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.4

3.4-EA

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.5

3.5-EA

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.6-RC1

3.6

3.6-EA

3.6-EA2

3.6-EA3

3.6.1

3.6.2

3.6.3

3.6.4

3.6.5

3.6.6

3.6.7

3.6.8

3.7

3.7-EA

3.7.1

3.7.2

3.7.3

3.7.4

3.7.5

3.7.6

3.7.7

3.7.8

3.8-RC1

3.8

3.8-EA

3.8.1

3.8.2

3.8.3

3.8.4

3.8.5

3.8.6

3.8.7

3.8.8

3.8.9

3.9

3.9-EA

3.9.1

3.9.2

3.9.3

3.9.4

3.10-BETA-1

3.10-BETA-2

3.10

3.10.1

3.10.2

3.10.3

3.10.4

3.10.5

3.10.6

3.10.7

3.11-BETA-1