CVE-2021-37578

Apache jUDDI uses several classes related to Java's Remote Method Invocation RMI which as an extension to UDDI provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicio...

CVE-2021-37578

Apache jUDDI uses several classes related to Java's Remote Method Invocation RMI which as an extension to UDDI provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicio...

CVE-2021-37578 Remote code execution via RMI

Apache jUDDI uses several classes related to Java's Remote Method Invocation RMI which as an extension to UDDI provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicio...

org.apache.geronimo.plugins:uddi-war-repackage (>=3.0-beta-1, <=3.0.1), org.apache.juddi.client.plugins:juddi-ddl-generator (>=3.2.1, <=3.3.4) +15 more potentially affected by CVE-2021-37578 via org.apache.juddi:juddi-core (>=3.0.0.alpha, <=3.3.9)

org.apache.juddi:juddi-core MAVEN version =3.0.0.alpha, =3.0-beta-1, =3.2.1, =3.2.1, =3.3.8, =3.0.0.alpha, =3.0.3, =3.0.0.alpha, =3.3.5, =3.0.0, =3.0.0.rc1, =3.2.0, =3.0.0.rc1, =3.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2021-37578 Source advisory: MEND:CVE-2021-37578...

CVE-2021-37578

Apache jUDDI prior to 3.3.10 exposed a deserialization-based remote code execution vector via RMI. The issue arises from Java serialization in RMI entries, potentially allowing remote code execution if exploited. RMI is disabled by default for jUDDI web services/clients, and starting with 3.3.10 ...