PT-2017-10744 · Lightbend · Akka

Adrian Bravo + 1 · Publicado 2017-07-13 · Atualizado 2018-10-22 · CVE-2017-1000034

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Akka versions <=2.4.16 Akka version 2.5-M1

Description The issue concerns a Java deserialization attack in the Remoting component of Akka, which can result in remote code execution in the context of the ActorSystem.

Recommendations For Akka versions <=2.4.16, update to a version greater than 2.4.16 to resolve the issue. For Akka version 2.5-M1, update to a version greater than 2.5-M1 to resolve the issue. As a temporary workaround, consider restricting access to the Remoting component to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-1000034

GHSA-MM57-9J6Q-RXM2

Produtos afetados

Akka

Referências · 7

• https://github.com/akka/akka/issues/22283 · Nota
• https://github.com/akka/akka/commit/cc6561b47e5958923df520b8a9514010d3e11d49 · Nota
• https://osv.dev/vulnerability/CVE-2017-1000034 · Aviso do Fabricante
• http://doc.akka.io/docs/akka/2.4/security/2017-02-10-java-serialization.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000034 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mm57-9j6q-rxm2 · Aviso do Fabricante
• https://github.com/advisories/GHSA-mm57-9j6q-rxm2 · Nota