PT-2017-9026 · Apache+3 · Apache Groovy+3
Publicado
2017-08-17
·
Atualizado
2022-05-13
·
CVE-2016-6814
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Groovy versions 1.7.0 through 2.4.3
Apache Groovy versions 2.4.4 through 2.4.7
Description
The issue allows an attacker to execute code directly when a specially crafted serialized object is deserialized, potentially affecting applications that rely on serialization and do not isolate the deserialization code. This could be exploited when an application uses standard Java serialization mechanisms, such as communicating between servers or storing local data.
Recommendations
For Apache Groovy versions 1.7.0 through 2.4.3, consider isolating the code that deserializes objects to minimize the risk of exploitation.
For Apache Groovy versions 2.4.4 through 2.4.7, consider isolating the code that deserializes objects to minimize the risk of exploitation.
As a temporary workaround, consider restricting the use of standard Java serialization mechanisms until a patch is available.
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Groovy
Centos
Red Hat
Ubuntu