PT-2019-15206 · Apache · Apache Olingo

Artem Smotrakov · Published 2019-12-04 · Updated 2020-02-04 · CVE-2019-17556

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Olingo versions 4.0.0 through 4.6.0

Description The issue concerns the AbstractService class in Apache Olingo, which uses ObjectInputStream without checking the classes being deserialized. This could allow an attacker to execute malicious code if they can provide malicious metadata to the class.

Recommendations For Apache Olingo versions 4.0.0 through 4.6.0, consider restricting access to the AbstractService class until a patch is available. As a temporary workaround, avoid using the ObjectInputStream functionality in the AbstractService class to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-17556

GHSA-GJ76-429M-56WC

Affected Products

Apache Olingo

References · 6

• https://osv.dev/vulnerability/GHSA-gj76-429m-56wc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17556 · Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d4vbSYaVh3aUWAvcVHK2qcFxxCZd3WAx3xbwZXskPX8nw%40mail.gmail.com%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17556 · Security Note
• https://github.com/apache/olingo-odata4/pull/60/files · Note
• https://issues.apache.org/jira/browse/OLINGO-1410 · Note