com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=2.0.0 <=2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=2.0.0 <=3.0.4) +53 more potentially affected by CVE-2022-37022 via org.apache.geode:geode-core (>=1.0.0-incubating <=1.14.4)

org.apache.geode:geode-core MAVEN version =1.0.0-incubating, =2.0.0, =2.0.0, =2.0.0, =0.3.12, =0.3.5, =2.4.0, =1.22.0, =1.14.0, =1.10.0, =1.10.0, =1.10.0, =1.12.0, =1.11.0, =1.14.4 and more Source cves: CVE-2022-37022 Source advisory: OSV:GHSA-QF8G-VPWP-6579...

org.apache.geode:geode-lucene (=1.1.0), org.apache.geode:geode-modules (=1.1.0) +5 more potentially affected by CVE-2017-5649 via org.apache.geode:geode-core (=1.1.0)

org.apache.geode:geode-core MAVEN version =1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.geode:geode-core and may be impacted: - org.apache.geode:geode-lucene =1.1.0 - org.apache.geode:geode-modules =1.1.0 -...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10 <=2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10 <=6.0.2) +71 more potentially affected by CVE-2017-15696 via org.apache.geode:geode-core (>=1.10.0 <=1.3.0)

org.apache.geode:geode-core MAVEN version =1.10.0, =0.10, =0.10, =2.0.0, =0.1.9, =2.4.0, =1.16.0, =1.14.0, =1.10.0, =1.10.0, =1.10.0, =1.12.0, =1.11.0, =1.15.3 and more Source cves: CVE-2017-15696 Source advisory: OSV:GHSA-G569-49WG-JX5F...

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (>=0.10 <=2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=0.10 <=6.0.2) +71 more potentially affected by CVE-2017-9795 via org.apache.geode:geode-core (>=1.10.0 <=1.2.1)

org.apache.geode:geode-core MAVEN version =1.10.0, =0.10, =0.10, =2.0.0, =0.1.9, =2.4.0, =1.22.0, =1.14.0, =1.10.0, =1.10.0, =1.10.0, =1.12.0, =1.11.0, =1.15.3 and more Source cves: CVE-2017-9795 Source advisory: OSV:GHSA-6M68-3W55-6MX4...

Unauthorized Access

geode-core is vulnerable to unauthorized access through gfsh authorization. The vulnerability exists as a user who is connected using the to the Geode cluster, using gfsh tool over HTTP, is able to read status information as well as control cluster members even without CLUSTER:MANAGE privileges...