PT-2019-7546 · Hazelcast · Hazelcast

Drosenbauer · Published 2019-05-22 · Updated 2022-05-24 · CVE-2016-10750

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hazelcast versions prior to 3.11

Description The cluster join procedure in Hazelcast is susceptible to remote code execution via Java deserialization. An attacker can exploit this by sending a crafted JoinRequest to a listening Hazelcast instance, allowing them to run arbitrary code if vulnerable classes are present in the classpath.

Recommendations For versions prior to 3.11, update to version 3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the Hazelcast instance to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-02985

CVE-2016-10750

GHSA-JV65-PF7V-F7P8

Affected Products

Hazelcast

References · 11

• https://osv.dev/vulnerability/GHSA-jv65-pf7v-f7p8 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2413 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10750 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02985 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10750 · Security Note
• https://github.com/hazelcast/hazelcast/pull/12230 · Note
• https://github.com/hazelcast/hazelcast/issues/8024 · Note
• https://jira.atlassian.com/browse/BSERV-13173 · Note
• https://vuldb.com/?id.198268 · Note
• https://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html · Note
• https://github.com/advisories/GHSA-2p9p-h8q6-52g9 · Note