CVE-2022-37023

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details o...

com.antgroup.tugraph:calcite-geode (>=1.18.0-geaflow_1.0, <=1.18.0-geaflow_1.1), com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10, <=2.0.2) +74 more potentially affected by CVE-2022-37023 via org.apache.geode:geode-core (>=1.0.0-incubating, <=1.14.4)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =1.18.0-geaflow1.0, =0.10, =0.10, =1.1.0, =1.0-m3, =1.21.0.138, =0.3.12, =0.3.5, =0.1.9, =2.2.0, =1.0.0, =1.7.5, =1.11.1 and more Source cves: CVE-2022-37023 Source advisory: MEND:CVE-2022-37023...

CVE-2022-37023 Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details o...

CVE-2022-37023

Apache Geode (prior to 1.15.0) is vulnerable to deserialization of untrusted data via REST APIs when running on Java 8 or Java 11. The root cause is untrusted data deserialization during REST operations, enabling attackers to potentially execute arbitrary code. Mitigation per the sources is to up...