PT-2019-7546 · Hazelcast · Hazelcast

Drosenbauer · Publicado 2019-05-22 · Atualizado 2022-05-24 · CVE-2016-10750

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hazelcast versions prior to 3.11

Description The cluster join procedure in Hazelcast is susceptible to remote code execution via Java deserialization. An attacker can exploit this by sending a crafted JoinRequest to a listening Hazelcast instance, allowing them to run arbitrary code if vulnerable classes are present in the classpath.

Recommendations For versions prior to 3.11, update to version 3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the Hazelcast instance to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2022-02985

CVE-2016-10750

GHSA-JV65-PF7V-F7P8

Produtos afetados

Hazelcast

Referências · 11

• https://github.com/hazelcast/hazelcast/pull/12230 · Nota
• https://github.com/hazelcast/hazelcast/issues/8024 · Nota
• https://osv.dev/vulnerability/GHSA-jv65-pf7v-f7p8 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:2413 · Aviso do Fabricante
• https://jira.atlassian.com/browse/BSERV-13173 · Nota
• https://osv.dev/vulnerability/CVE-2016-10750 · Aviso do Fabricante
• https://vuldb.com/?id.198268 · Nota
• https://bdu.fstec.ru/vul/2022-02985 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-10750 · Nota de Segurança
• https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html · Nota
• https://github.com/advisories/GHSA-2p9p-h8q6-52g9 · Nota