PT-2022-4604 · Apache · Apache Geode

Kirk Lund · Published 2022-08-31 · Updated 2022-09-06 · CVE-2022-37022

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Geode versions up to 1.12.2 and 1.13.2

Description The issue is related to the deserialization of untrusted data when using JMX over RMI on Java 11, which can allow a remote attacker to execute arbitrary code. This flaw affects the JMX service of the Apache Geode data management platform. To protect against deserialization attacks involving JMX or RMI, users should upgrade to Apache Geode 1.15, which automatically protects JMX over RMI against such attacks when used with Java 11.

Recommendations For Apache Geode versions up to 1.12.2 and 1.13.2, upgrade to Apache Geode 1.15 to protect against deserialization attacks involving JMX or RMI. This upgrade should have no impact on performance, as it only affects JMX/RMI, which is used by Gfsh to communicate with the JMX Manager hosted on a Locator.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-05482

CVE-2022-37022

GHSA-QF8G-VPWP-6579

Affected Products

Apache Geode

References · 8

• https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05482 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-37022 · Security Note
• https://osv.dev/vulnerability/GHSA-qf8g-vpwp-6579 · Vendor Advisory
• https://t.me/cvenotify/35491 · Telegram Post
• https://t.me/cibsecurity/49095 · Telegram Post
• https://t.me/cvenotify/35502 · Telegram Post