PT-2016-6220 · Apache · Apache Myfaces Trinidad

Published 2016-10-03 · Updated 2022-05-13 · CVE-2016-5019

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache MyFaces Trinidad versions 1.0.0 through 1.0.13 Apache MyFaces Trinidad versions 1.2.x before 1.2.15 Apache MyFaces Trinidad versions 2.0.x before 2.0.2 Apache MyFaces Trinidad versions 2.1.x before 2.1.2

Description The issue allows attackers to conduct deserialization attacks via a crafted serialized view state string. This could potentially be exploited by sending a malicious string to the CoreResponseStateManager in Apache MyFaces Trinidad.

Recommendations For versions 1.0.0 through 1.0.13, update to a version after 1.0.13 to resolve the issue. For versions 1.2.x before 1.2.15, update to version 1.2.15 or later to resolve the issue. For versions 2.0.x before 2.0.2, update to version 2.0.2 or later to resolve the issue. For versions 2.1.x before 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting the input to the CoreResponseStateManager to prevent deserialization attacks via crafted serialized view state strings.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2016-5019

GHSA-X7RC-4GQW-3Q6Q

Affected Products

Apache Myfaces Trinidad

References · 19

• http://oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html · Patch
• https://osv.dev/vulnerability/CVE-2016-5019 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Patch
• https://osv.dev/vulnerability/GHSA-x7rc-4gqw-3q6q · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/myfaces-users/201609.mbox/%3CCAM1yOjYM%2BEW3mLUfX0pNAVLfUFRAw-Bhvkp3UE5%3DEQzR8Yxsfw%40mail.gmail.com%3E · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujul2016-2881720.html · Patch
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-5019 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Patch
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Patch
• https://issues.apache.org/jira/browse/TRINIDAD-2542 · Vendor Advisory
• https://github.com/apache/myfaces-trinidad · Note
• https://oracle.com/security-alerts/cpujul2020.html · Note
• https://web.archive.org/web/20171129092136/http://securitytracker.com/id/1037633 · Note
• http://securitytracker.com/id/1037633 · Note