GHSA-xphj-m9cc-8fmq

Source

https://github.com/advisories/GHSA-xphj-m9cc-8fmq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xphj-m9cc-8fmq/GHSA-xphj-m9cc-8fmq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xphj-m9cc-8fmq

Aliases

CVE-2016-6814

Published

2022-05-13T01:25:19Z

Modified

2024-10-17T16:23:10.153350Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Deserialization of Untrusted Data in Groovy

Details

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.

Database specific

{
    "nvd_published_at": "2018-01-18T18:29:00Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T19:46:12Z"
}

References

Affected packages

Maven / org.codehaus.groovy:groovy

Package

Name: org.codehaus.groovy:groovy; View open source insights on deps.dev
Purl: pkg:maven/org.codehaus.groovy/groovy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.7.0

Fixed

2.4.8

Affected versions

1.*

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7.10

1.7.11

1.8.0-beta-1

1.8.0-beta-2

1.8.0-beta-3

1.8.0-beta-4

1.8.0-rc-1

1.8.0-rc-2

1.8.0-rc-3

1.8.0-rc-4

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9.0-beta-1

1.9.0-beta-2

1.9.0-beta-3

1.9.0-beta-4

2.*

2.0.0-beta-1

2.0.0-beta-2

2.0.0-beta-3

2.0.0-rc-1

2.0.0-rc-2

2.0.0-rc-3

2.0.0-rc-4

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.0-beta-1

2.1.0-rc-1

2.1.0-rc-2

2.1.0-rc-3

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0-beta-1

2.2.0-beta-2

2.2.0-rc-1

2.2.0-rc-2

2.2.0-rc-3

2.2.0

2.2.1

2.2.2

2.3.0-beta-1

2.3.0-beta-2

2.3.0-rc-1

2.3.0-rc-2

2.3.0-rc-4

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.4.0-beta-1

2.4.0-beta-2

2.4.0-beta-3

2.4.0-beta-4

2.4.0-rc-1

2.4.0-rc-2

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

Database specific

{
    "last_known_affected_version_range": "<= 2.4.7"
}

Maven / org.codehaus.groovy:groovy-all