PT-2017-9026 · Apache+3 · Apache Groovy+3

Published 2017-08-17 · Updated 2022-05-13 · CVE-2016-6814

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Groovy versions 1.7.0 through 2.4.3 Apache Groovy versions 2.4.4 through 2.4.7

Description The issue allows an attacker to execute code directly when a specially crafted serialized object is deserialized, potentially affecting applications that rely on serialization and do not isolate the deserialization code. This could be exploited when an application uses standard Java serialization mechanisms, such as communicating between servers or storing local data.

Recommendations For Apache Groovy versions 1.7.0 through 2.4.3, consider isolating the code that deserializes objects to minimize the risk of exploitation. For Apache Groovy versions 2.4.4 through 2.4.7, consider isolating the code that deserializes objects to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of standard Java serialization mechanisms until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CESA-2017_2486

CVE-2016-6814

DLA-794-1

GHSA-XPHJ-M9CC-8FMQ

MGASA-2017-0311

RHSA-2017:2486

RHSA-2017:2596

RHSA-2017_2486

USN-4795-1

ZDI-17-044

Affected Products

Apache Groovy

Centos

Red Hat

Ubuntu

References · 42

• https://security-tracker.debian.org/tracker/CVE-2016-6814 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-01 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2486 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4795-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-2486.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0868 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6814 · Security Note
• https://advisories.mageia.org/MGASA-2017-0311.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3253 · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-0272.html · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6814 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6814 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2596 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/A5FSJEOEIYPZDGJRMEPJPMUMDN4MQQJI · Vendor Advisory