PT-2022-4609 · Apache+1 · Apache Geode+1

Kirk Lund · Published 2022-08-31 · Updated 2022-09-07 · CVE-2022-37021

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0

Description The issue is related to the deserialization of untrusted data when using JMX over RMI on Java 8, which can allow a remote attacker to execute arbitrary code. To protect against deserialization attacks involving JMX or RMI, users should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then users should upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Using a global serial filter will impact performance.

Recommendations For Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0, upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-05487

CVE-2022-37021

GHSA-Q4Q3-R45F-7GWG

Affected Products

Apache Geode

Java

References · 8

• https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37021 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37021 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4q3-r45f-7gwg · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05487 · Security Note
• https://t.me/cvenotify/35503 · Telegram Post
• https://t.me/cibsecurity/49093 · Telegram Post
• https://t.me/cvenotify/35492 · Telegram Post