Описание
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.
Меры по смягчению последствий
Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java): public class MethodClosure extends Closure {
- private Object readResolve() {
-
throw new UnsupportedOperationException();
} Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | groovy-all | Not affected | ||
| Red Hat Enterprise Virtualization 3 | jasperreports-server-pro | Affected | ||
| Red Hat JBoss BRMS 5 | groovy-all | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 5 | groovy-all | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse | Affected | ||
| Red Hat JBoss Fuse Service Works 6 | groovy-all | Affected | ||
| Red Hat JBoss Portal 6 | groovy-all | Affected | ||
| Red Hat JBoss SOA Platform 4 | groovy-all | Will not fix | ||
| Red Hat OpenShift Enterprise 2 | jenkins | Will not fix | ||
| Red Hat Enterprise Linux 7 | groovy | Fixed | RHSA-2017:2486 | 17.08.2017 |
Показывать по
Дополнительная информация
Статус:
9.6 Critical
CVSS3
6.8 Medium
CVSS2
Связанные уязвимости
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy ...
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
9.6 Critical
CVSS3
6.8 Medium
CVSS2