PT-2019-15206 · Apache · Apache Olingo

Artem Smotrakov · Publicado 2019-12-04 · Atualizado 2020-02-04 · CVE-2019-17556

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Olingo versions 4.0.0 through 4.6.0

Description The issue concerns the AbstractService class in Apache Olingo, which uses ObjectInputStream without checking the classes being deserialized. This could allow an attacker to execute malicious code if they can provide malicious metadata to the class.

Recommendations For Apache Olingo versions 4.0.0 through 4.6.0, consider restricting access to the AbstractService class until a patch is available. As a temporary workaround, avoid using the ObjectInputStream functionality in the AbstractService class to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-17556

GHSA-GJ76-429M-56WC

Produtos afetados

Apache Olingo

Referências · 6

• https://github.com/apache/olingo-odata4/pull/60/files · Nota
• https://osv.dev/vulnerability/GHSA-gj76-429m-56wc · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-17556 · Aviso do Fabricante
• https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d4vbSYaVh3aUWAvcVHK2qcFxxCZd3WAx3xbwZXskPX8nw%40mail.gmail.com%3E · Aviso do Fabricante
• https://issues.apache.org/jira/browse/OLINGO-1410 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17556 · Nota de Segurança