PT-2017-10744 · Lightbend · Akka

Adrian Bravo + 1 · Published 2017-07-13 · Updated 2018-10-22 · CVE-2017-1000034

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Akka versions <=2.4.16 Akka version 2.5-M1

Description The issue concerns a Java deserialization attack in the Remoting component of Akka, which can result in remote code execution in the context of the ActorSystem.

Recommendations For Akka versions <=2.4.16, update to a version greater than 2.4.16 to resolve the issue. For Akka version 2.5-M1, update to a version greater than 2.5-M1 to resolve the issue. As a temporary workaround, consider restricting access to the Remoting component to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-1000034

GHSA-MM57-9J6Q-RXM2

Affected Products

Akka

References · 7

• https://osv.dev/vulnerability/CVE-2017-1000034 · Vendor Advisory
• http://doc.akka.io/docs/akka/2.4/security/2017-02-10-java-serialization.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000034 · Security Note
• https://osv.dev/vulnerability/GHSA-mm57-9j6q-rxm2 · Vendor Advisory
• https://github.com/akka/akka/issues/22283 · Note
• https://github.com/akka/akka/commit/cc6561b47e5958923df520b8a9514010d3e11d49 · Note
• https://github.com/advisories/GHSA-mm57-9j6q-rxm2 · Note