CVE-2022-37022

Severity CVSS v4.0:

Pending analysis

Type:

CWE-502 Deserialization of Untrusted Dat

Publication date:

31/08/2022

Last modified:

06/09/2022

Description

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.80 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

8.80

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:apache:geode::::::::		1.12.2 (including)
cpe:2.3:a:apache:geode::::::::	1.13.0 (including)	1.13.2 (including)

To consult the complete list of CPE names with products and versions, see this page

References to Advisories, Solutions, and Tools

https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4m