Veracode Vulnerability DatabaseVERACODE:12573Remote Code Execution Through Object Deserialization
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object. Apache Groovy 2.4.4 is the first and only supported release under the Apache Software Foundation. It is strongly recommended that all users upgrade to this version. If you cannot upgrade or rely on an older, unsupported version of Groovy, you can apply the patch found in the Vendor disclosure link in the references.
| CPE | Name | Operator | Version |
|---|---|---|---|
| rh-maven33-groovy | eq | 1.8.9__7.18.el6 | |
| rh-maven33-groovy | eq | 1.8.9__7.18.el7 | |
| groovy | eq | 1.8.9__7.el7 |
References
groovy-lang.org/security.html
packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html
rhn.redhat.com/errata/RHSA-2016-0066.html
www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
www.securityfocus.com/archive/1/536012/100/0/threaded
www.securityfocus.com/bid/75919
www.securityfocus.com/bid/91787
www.securitytracker.com/id/1034815
www.zerodayinitiative.com/advisories/ZDI-15-365/
access.redhat.com/errata/RHSA-2016:1376
access.redhat.com/errata/RHSA-2017:2486
access.redhat.com/errata/RHSA-2017:2596
access.redhat.com/security/updates/classification/#important
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E
security.gentoo.org/glsa/201610-01
security.netapp.com/advisory/ntap-20160623-0001/
www.oracle.com/security-alerts/cpuapr2020.html
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P