PT-2018-18383 · Apache · Apache Ignite

Published 2018-07-19 · Updated 2019-02-28 · CVE-2018-8018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Ignite versions prior to 2.4.8 Apache Ignite versions 2.5.x prior to 2.5.3

Description: The serialization mechanism in Apache Ignite does not have a list of classes allowed for serialization/deserialization. This allows for the execution of arbitrary code when third-party vulnerable classes are present in the Ignite classpath. The issue can be exploited by sending a specially prepared serialized object to the GridClientJdkMarshaller deserialization endpoint.

Recommendations: For Apache Ignite versions prior to 2.4.8, update to version 2.4.8 or later. For Apache Ignite versions 2.5.x prior to 2.5.3, update to version 2.5.3 or later. As a temporary workaround, consider restricting access to the GridClientJdkMarshaller deserialization endpoint to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-8018

GHSA-QCJV-WFCG-MMPR

Affected Products

Apache Ignite

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2018-8018 · Security Note
• https://osv.dev/vulnerability/GHSA-qcjv-wfcg-mmpr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8018 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3768 · Vendor Advisory
• https://github.com/apache/ignite/commit/82a7b8209fcf56971d12cb10410a38ed632215b · Note
• https://lists.apache.org/thread.html/e0fdf53114a321142ecfa5cfa17658090f0b4e1677de431e329b37ab@%3Cdev.ignite.apache.org%3E · Note
• https://lists.apache.org/thread.html/e0fdf53114a321142ecfa5cfa17658090f0b4e1677de431e329b37ab%40%3Cdev.ignite.apache.org%3E · Note
• https://issues.apache.org/jira/browse/IGNITE-8565 · Note
• http://securityfocus.com/bid/104911 · Note
• https://github.com/advisories/GHSA-qcjv-wfcg-mmpr · Note