CVE-2019-17556

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case...

Design/Logic Flaw

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case...

CVE-2019-17556

CVE-2019-17556 concerns Apache Olingo, where versions 4.0.0 to 4.6.0 expose the AbstractService class (public API) that uses ObjectInputStream without validating deserialized classes. This unsafe deserialization could let an attacker feed malicious metadata and potentially execute attacker-contro...