CVE-2017-15693

Apache Geode prior to v1.4.0 stores objects in serialized form, and certain cluster operations and API invocations deserialize these objects. A user with DATA:WRITE access to the cluster may trigger remote code execution if certain classes are present on the classpath. The issue is rooted in unsa...

CVE-2017-9795

CVE-2017-9795 affects Apache Geode clusters running in secure mode prior to v1.3.0. A user with read access to specific regions can execute OQL queries that read/write objects in unauthorized regions and may invoke methods enabling remote code execution. The documents do not specify exploit vecto...

CVE-2019-10091

CVE-2019-10091 affects Apache Geode. When TLS is enabled and ssl-endpoint-identification-enabled is true, Geode may fail to verify hostnames in the certificate SAN during the SSL handshake, enabling potential man-in-the-middle scenarios and compromising intra-cluster communications. The issue is ...

CVE-2021-34797

CVE-2021-34797 affects Apache Geode up to 1.12.4 and 1.13.4, where log file redaction mishandles values starting with non-alphanumeric characters for passwords and security properties prefixed with “sysprop-”, “javax.net.ssl”, or “security-”. This could lead to sensitive information being written...

CVE-2017-12622

Summary: Apache Geode gfsh authorization vuln allows an authenticated user to read status information and control cluster members via HTTP in clusters running a Geode version before 1.3.0, even without CLUSTER:MANAGE privileges. Affected product/version: Apache Geode; versions before 1.3.0. Impac...

CVE-2017-15696

The CVE-2017-15696 entry affects Apache Geode before v1.4.0. In secure mode, the Geode configuration service fails to properly authorize configuration requests, allowing an unprivileged user with access to a Geode locator to extract configuration data and previously deployed application code. Con...

CVE-2017-5649

CVE-2017-5649 affects Apache Geode prior to 1.1.1. When a cluster has security-manager enabled, remote authenticated users with CLUSTER:READ but not DATA:READ can access the data browser page in Pulse and run an OQL query, exposing data stored in the cluster. The vulnerability is demonstrated by ...