GHSA-qf8g-vpwp-6579

Source

https://github.com/advisories/GHSA-qf8g-vpwp-6579

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-qf8g-vpwp-6579/GHSA-qf8g-vpwp-6579.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qf8g-vpwp-6579

Aliases

CVE-2022-37022

Published

2022-09-01T00:00:26Z

Modified

2023-11-08T04:10:06.427512Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Geode versions deserialization of untrusted datawhen using JMX over RMI on Java 11

Details

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.

Database specific

{
    "nvd_published_at": "2022-08-31T07:15:00Z",
    "github_reviewed_at": "2022-09-16T19:26:04Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Maven / org.apache.geode:geode-core

Package

Name: org.apache.geode:geode-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.geode/geode-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.15.0

Affected versions

1.*

1.0.0-incubating.M2

1.0.0-incubating.M3

1.0.0-incubating

1.1.0

1.1.1

1.2.0

1.2.1

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.8.0

1.9.0

1.9.1

1.9.2

1.10.0

1.11.0

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

1.12.8

1.12.9

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.13.8

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4