PT-2015-3696 · Apache · Apache Tapestry

Takeshi Terada · Publicado 2015-08-22 · Atualizado 2022-05-13 · CVE-2014-1972

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Tapestry versions prior to 5.3.6

Description The issue allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized data, due to the reliance on client-side object storage without proper checks.

Recommendations For versions prior to 5.3.6, update to version 5.3.6 or later to resolve the issue.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-399

CWE-502

Identificadores relacionados

CVE-2014-1972

GHSA-C438-8CVQ-PXXX

Produtos afetados

Apache Tapestry

Referências · 18

• https://github.com/apache/tapestry-5 · Nota
• https://github.com/apache/tapestry-5/commit/5ad5257fdfacbad2c7c480fdf2afa15d9a37e6b0 · Nota
• http://seclists.org/fulldisclosure/2019/Aug/20 · Nota
• https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c@%3Cusers.tapestry.apache.org%3E · Nota
• https://lists.apache.org/thread.html/84e99dedad2ecb4676de93c3ab73a8a10882951ab6984f514707f3d9@%3Cusers.tapestry.apache.org%3E · Nota
• http://jvn.jp/en/jp/JVN17611367/index.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c@%3Ccommits.tapestry.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1972 · Nota de Segurança
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000118 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/TAP5-2008 · Nota
• https://lists.apache.org/thread.html/84e99dedad2ecb4676de93c3ab73a8a10882951ab6984f514707f3d9%40%3Cusers.tapestry.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E · Nota
• https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E · Nota
• http://openwall.com/lists/oss-security/2019/08/23/5 · Nota
• https://osv.dev/vulnerability/GHSA-c438-8cvq-pxxx · Aviso do Fabricante