PT-2022-4605 · Apache · Apache Geode

Kirk Lund · Published 2022-08-31 · Updated 2022-09-06 · CVE-2022-37023

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.15.0

Description The issue is related to the restoration of untrusted data in memory through the REST API interface of the Apache Geode data management platform. This can allow a remote attacker to execute arbitrary code. The vulnerability is associated with the deserialization of untrusted data when using the REST API on Java 8 or Java 11.

Recommendations To protect against deserialization attacks involving REST APIs, upgrade to Apache Geode 1.15.0 and follow the documentation for details on enabling validate-serializable-objects=true and specifying any user classes that may be serialized/deserialized with serializable-object-filter. Note that enabling validate-serializable-objects may impact performance.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-05483

CVE-2022-37023

GHSA-72X9-48MC-PHH6

Affected Products

Apache Geode

References · 8

• https://osv.dev/vulnerability/CVE-2022-37023 · Vendor Advisory
• https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37023 · Security Note
• https://bdu.fstec.ru/vul/2022-05483 · Security Note
• https://osv.dev/vulnerability/GHSA-72x9-48mc-phh6 · Vendor Advisory
• https://t.me/cvenotify/35501 · Telegram Post
• https://t.me/cibsecurity/49094 · Telegram Post
• https://t.me/cvenotify/35490 · Telegram Post