Описание
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.
Отчет
This issue affects the versions of groovy as shipped with Red Hat Satellite 6.0 and 6.1. Red Hat Satellite 6.2 and later do not ship groovy, as such they are not affected by this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Virtualization 3 | jasperreports-server-pro | Will not fix | ||
| Red Hat JBoss A-MQ 6 | groovy | Affected | ||
| Red Hat JBoss BRMS 5 | groovy | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 5 | groovy | Will not fix | ||
| Red Hat JBoss Fuse 6 | camel | Affected | ||
| Red Hat JBoss Fuse Service Works 6 | camel | Affected | ||
| Red Hat JBoss Operations Network 3 | groovy | Not affected | ||
| Red Hat JBoss Portal 5 | groovy | Under investigation | ||
| Red Hat JBoss SOA Platform 5 | groovy | Will not fix | ||
| Red Hat OpenShift Enterprise 2 | jenkins | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
9.6 Critical
CVSS3
Связанные уязвимости
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
When an application with unsupported Codehaus versions of Groovy from ...
EPSS
9.6 Critical
CVSS3