PT-2015-6124 · Apache+2 · Apache Groovy+2

Published 2015-07-20 · Updated 2024-08-06 · CVE-2015-3253

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Groovy versions 1.7.0 through 2.4.3

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object. This is related to the deserialization of untrusted data in Apache Groovy.

Recommendations For Apache Groovy versions 1.7.0 through 2.4.3, consider avoiding the deserialization of untrusted data as a temporary workaround until a patch is available. Restrict access to the MethodClosure class to minimize the risk of exploitation.

Fix

RCE

DoS

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CESA-2017_2486

CVE-2015-3253

DLA-274-1

GHSA-QG25-HGJV-CG9Q

MGASA-2015-0296

MGASA-2017-0333

RHSA-2017:2486

RHSA-2017:2596

RHSA-2017_2486

ZDI-15-365

Affected Products

Apache Groovy

Centos

Red Hat

References · 50

• http://rhn.redhat.com/errata/RHSA-2016-0066.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2486 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3253 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3253 · Security Note
• https://access.redhat.com/errata/RHSA-2016:1376 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html · Patch
• https://zerodayinitiative.com/advisories/ZDI-15-365 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0296 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujul2016-2881720.html · Patch
• https://access.redhat.com/errata/RHSA-2017:2596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3253 · Security Note
• https://ubuntu.com/security/CVE-2015-3253 · Vendor Advisory
• http://groovy-lang.org/security.html · Vendor Advisory
• https://security.gentoo.org/glsa/201610-01 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3253 · Vendor Advisory