CWE-502
AllowedDeserialization of Untrusted Data
Abstraction: Base · Status: Draft
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
4798 vulnerabilities reference this CWE, most recent first.
GHSA-H9W3-F7X6-V54C
Vulnerability from github – Published: 2021-09-20 23:18 – Updated: 2021-10-28 16:14Withdrawn
was withdrawn by its CNA. Further investigation showed that it was not a security issue.
Original Description
All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.jsoniter:jsoniter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.9.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23441"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-20T20:25:57Z",
"nvd_published_at": "2021-09-19T14:15:00Z",
"severity": "HIGH"
},
"details": "# Withdrawn\n\nwas withdrawn by its CNA. Further investigation showed that it was not a security issue. \n\n## Original Description\n\nAll versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.",
"id": "GHSA-h9w3-f7x6-v54c",
"modified": "2021-10-28T16:14:46Z",
"published": "2021-09-20T23:18:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23441"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-COMJSONITER-1316198"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Deserialization of Untrusted Data in com.jsoniter:jsoniter",
"withdrawn": "2021-10-28T16:13:59Z"
}
GHSA-HC33-32VW-RPP9
Vulnerability from github – Published: 2021-07-01 17:01 – Updated: 2021-10-21 14:14Impact
A malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store.
If your application does not use Ratpack's session mechanism, it is not vulnerable.
Details
Attackers with the ability to write to session data, can potentially craft payloads that deserialize unsafe objects, leading to the ability to remotely execute arbitrary code. This is known as an “insecure deserialization” vulnerability, or “gadget vulnerability”.
Ratpack allows session data to be stored server side in an external system such as a relational database, or client side via user cookies. When using server side storage, the attacker would need to obtain the ability to write to the session data store. When using client side storage, the attacker would need to obtain the secrets used to encrypt and/or sign the session data stored in user cookies.
Ratpack's session mechanism allows storing serialized objects, of arbitrary types. The type must be specified when writing the data and when reading, with data only deserialized when there is an exact type match. However, in the process of deserializing an object of a known/trusted/deserialization-safe type, it may attempt to deserialize unsafe types.
By default Ratpack uses Java's built-in serialization mechanism, though other serialization providers can be used. The exact types of payloads required to enable an exploit depend on the exact serialization mechanism used.
To mitigate this vulnerability, Ratpack now employs a “strict allow-list” when deserializing (and serializing) objects to session data. All concrete types of objects serialized must be explicitly declared as safe. Some standard well known JDK types are registered by default.
Serialization is provided by implementations of SessionSerializer.
Its existing methods have been deprecated, and replaced with a new methods that accept a SessionTypeFilter that can be used to assert whether a type is allowed when serializing and deserializing.
The default serializer implementation has been updated to use this mechanism. Any proprietary implementations should also be updated to consult the type filter before serializing or deserializing data. Warnings will be logged any time an implementation that does not implement the new methods is used.
Upon upgrading to Ratpack 1.9, users of the built-in serialization mechanism will need to change their application to declare all types currently being serialized as being safe. This can be done using the new SessionModule.allowTypes() method. Please see its documentation for details...))
Patches
Ratpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used.
Workarounds
The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store.
Alternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of SessionSerializer that uses an allow-list.
References
- https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
- https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.ratpack:ratpack-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-29485"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-30T17:46:45Z",
"nvd_published_at": "2021-06-29T19:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nA malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store.\n\nIf your application does not use Ratpack\u0027s session mechanism, it is not vulnerable.\n\n### Details\n\nAttackers with the ability to write to session data, can potentially craft payloads that deserialize unsafe objects, leading to the ability to remotely execute arbitrary code. \nThis is known as an \u201c[insecure deserialization](https://portswigger.net/web-security/deserialization)\u201d vulnerability, or \u201cgadget vulnerability\u201d.\n\nRatpack allows session data to be stored server side in an external system such as a relational database, or client side via user cookies.\nWhen using server side storage, the attacker would need to obtain the ability to write to the session data store.\nWhen using client side storage, the attacker would need to obtain the secrets used to encrypt and/or sign the session data stored in user cookies.\n\nRatpack\u0027s session mechanism allows storing serialized objects, of arbitrary types. \nThe type must be specified when writing the data and when reading, with data only deserialized when there is an exact type match.\nHowever, in the process of deserializing an object of a known/trusted/deserialization-safe type, it may attempt to deserialize unsafe types.\n\nBy default Ratpack uses Java\u0027s built-in serialization mechanism, though other serialization providers can be used.\nThe exact types of payloads required to enable an exploit depend on the exact serialization mechanism used.\n\nTo mitigate this vulnerability, Ratpack now employs a \u201cstrict allow-list\u201d when deserializing (and serializing) objects to session data. \nAll concrete types of objects serialized must be explicitly declared as safe.\nSome standard well known JDK types are registered by default.\n\nSerialization is provided by implementations of [`SessionSerializer`](https://ratpack.io/manual/1.9.0/api/ratpack/session/SessionSerializer.html).\nIts existing methods have been deprecated, and replaced with a [new methods](https://ratpack.io/manual/1.9.0/api/ratpack/session/SessionSerializer.html#deserialize(java.lang.Class,java.io.InputStream,ratpack.session.SessionTypeFilter)) that accept a [`SessionTypeFilter`](https://ratpack.io/manual/1.9.0/api/ratpack/session/SessionTypeFilter.html) that can be used to assert whether a type is allowed when serializing and deserializing.\n\nThe default serializer implementation has been updated to use this mechanism.\nAny proprietary implementations should also be updated to consult the type filter _before_ serializing or deserializing data.\nWarnings will be logged any time an implementation that does not implement the new methods is used.\n\nUpon upgrading to Ratpack 1.9, users of the built-in serialization mechanism will need to change their application to declare all types currently being serialized as being safe. This can be done using the new [`SessionModule.allowTypes()`](https://ratpack.io/manual/1.9.0/api/ratpack/session/SessionModule.html#allowTypes(com.google.inject.Binder,java.lang.Class...)) method. Please see its documentation for details...))\n\n### Patches\n\nRatpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used.\n\n### Workarounds\n\nThe simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store. \n\nAlternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list.\n\n### References\n\n - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/\n - https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data\n",
"id": "GHSA-hc33-32vw-rpp9",
"modified": "2021-10-21T14:14:24Z",
"published": "2021-07-01T17:01:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ratpack/ratpack/security/advisories/GHSA-hc33-32vw-rpp9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29485"
},
{
"type": "PACKAGE",
"url": "https://github.com/ratpack/ratpack"
},
{
"type": "WEB",
"url": "https://mvnrepository.com/artifact/io.ratpack/ratpack-core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Remote Code Execution Vulnerability in Session Storage"
}
GHSA-HC86-HG23-G2X8
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191055353
{
"affected": [],
"aliases": [
"CVE-2021-0685"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-06T15:15:00Z",
"severity": "HIGH"
},
"details": "In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191055353",
"id": "GHSA-hc86-hg23-g2x8",
"modified": "2022-05-24T19:16:48Z",
"published": "2022-05-24T19:16:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0685"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2021-09-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HC8C-89GG-5Q5V
Vulnerability from github – Published: 2025-11-06 18:32 – Updated: 2026-01-20 15:31Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
{
"affected": [],
"aliases": [
"CVE-2025-58636"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-06T16:15:59Z",
"severity": "CRITICAL"
},
"details": "Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through \u003c= 1.2.3.",
"id": "GHSA-hc8c-89gg-5q5v",
"modified": "2026-01-20T15:31:48Z",
"published": "2025-11-06T18:32:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58636"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/gf-infusionsoft/vulnerability/wordpress-wp-gravity-forms-keap-infusionsoft-plugin-1-2-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/gf-infusionsoft/vulnerability/wordpress-wp-gravity-forms-keap-infusionsoft-plugin-1-2-3-deserialization-of-untrusted-data-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/gf-infusionsoft/vulnerability/wordpress-wp-gravity-forms-keap-infusionsoft-plugin-1-2-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HCCH-P97Q-5WQ5
Vulnerability from github – Published: 2026-07-13 12:35 – Updated: 2026-07-13 12:35Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.
{
"affected": [],
"aliases": [
"CVE-2026-59521"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T10:16:46Z",
"severity": "HIGH"
},
"details": "Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through \u003c= 3.1.15.",
"id": "GHSA-hcch-p97q-5wq5",
"modified": "2026-07-13T12:35:05Z",
"published": "2026-07-13T12:35:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59521"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/testimonial-free/vulnerability/wordpress-real-testimonials-plugin-3-1-15-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HCHJ-8847-5V46
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 18:31Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
{
"affected": [],
"aliases": [
"CVE-2026-25029"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:16:42Z",
"severity": "CRITICAL"
},
"details": "Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through \u003c= 5.24.",
"id": "GHSA-hchj-8847-5v46",
"modified": "2026-03-26T18:31:33Z",
"published": "2026-03-25T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25029"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Theme/kidz/vulnerability/wordpress-kidz-theme-5-24-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HCRC-79HJ-M3QH
Vulnerability from github – Published: 2025-04-22 16:53 – Updated: 2025-10-22 19:27Summary
An unsafe deserialization vulnerability allows for remote code execution on Wazuh servers.
The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent.
Details
DistributedAPI parameters are a serialized as JSON and deserialized using as_wazuh_object (in framework/wazuh/core/cluster/common.py). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (__unhandled_exc__) to evaluate arbitrary python code.
Using the server API, it quite easy to trigger. For example, using the run_as endpoint (implemented by run_as_login in api/api/controllers/security_controller.py): the auth_context argument is completely controlled by the attacker, and is forwarded to the master server to handle. By sending a malicious run_as request to a worker server, it is possible to execute code on the master server.
It is also possible to exploit the bug as a compromised agent, in certain configurations.
A compromised agent can respond to a getconfig request with a malicious JSON object (containing a serialized unhandled exception). If the getconfig request was caused because of a server API request to /agents/{agent_id}/config/{component}/{configuration} (api.controllers.agent_controller.get_agent_config), and the agent is managed by a server other than the one that received the server API request, the unsafe deserialization will occur on the server that received the original server API request.
user server A server B agent
| | | |
| -get-config-> | | |
| | --get-config-dapi-> | |
| | | --getconf-> |
| | | <-payload-- |
| X <-----payload------ | |
| | | |
It is likely that there are more ways to reach the unsafe deserialization function (as_wazuh_object), some of them might even be accessible from different contexts (without credentials, or initiated by a compromised agent). I suggest fixing the root cause instead of attempting to sanitize inputs that reach it. Note that there are multiple other ways to execute arbitrary code in as_wazuh_object, easier by using a __callable__, or potentially abusing callable gadgets in exception, wresults or Wazuh.
PoC
To trigger using the server API (assuming default credentials):
curl -X POST -k -u "wazuh-wui:MyS3cr37P450r.*-" -H "Content-Type: application/json" --data '{"__unhandled_exc__":{"__class__": "exit", "__args__": []}}' https://<worker-server>:55000/security/user/authenticate/run_as
this will shut down the master server.
Impact
This is a remote code execution on Wazuh server, affecting the latest version (v4.9.0 at this time)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/wazuh/wazuh"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-24016"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T16:53:39Z",
"nvd_published_at": "2025-02-10T20:15:42Z",
"severity": "CRITICAL"
},
"details": "### Summary\nAn unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. \nThe vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent.\n\n### Details\nDistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. \n\nUsing the server API, it quite easy to trigger. For example, using the `run_as` endpoint (implemented by `run_as_login` in `api/api/controllers/security_controller.py`): the `auth_context` argument is completely controlled by the attacker, and is forwarded to the master server to handle. By sending a malicious `run_as` request to a worker server, it is possible to execute code on the master server.\n\nIt is also possible to exploit the bug as a compromised agent, in certain configurations. \nA compromised agent can respond to a `getconfig` request with a malicious JSON object (containing a serialized unhandled exception). If the `getconfig` request was caused because of a server API request to `/agents/{agent_id}/config/{component}/{configuration}` (`api.controllers.agent_controller.get_agent_config`), and the agent is managed by a server other than the one that received the server API request, the unsafe deserialization will occur on the server that received the original server API request.\n\n```\nuser server A server B agent\n | | | |\n | -get-config-\u003e | | |\n | | --get-config-dapi-\u003e | |\n | | | --getconf-\u003e |\n | | | \u003c-payload-- |\n | X \u003c-----payload------ | |\n | | | |\n```\n\nIt is likely that there are more ways to reach the unsafe deserialization function (`as_wazuh_object`), some of them might even be accessible from different contexts (without credentials, or initiated by a compromised agent). I suggest fixing the root cause instead of attempting to sanitize inputs that reach it. Note that there are multiple other ways to execute arbitrary code in `as_wazuh_object`, easier by using a `__callable__`, or potentially abusing callable gadgets in `exception`, `wresults` or `Wazuh`.\n\n### PoC\nTo trigger using the server API (assuming default credentials): \n```bash\ncurl -X POST -k -u \"wazuh-wui:MyS3cr37P450r.*-\" -H \"Content-Type: application/json\" --data \u0027{\"__unhandled_exc__\":{\"__class__\": \"exit\", \"__args__\": []}}\u0027 https://\u003cworker-server\u003e:55000/security/user/authenticate/run_as\n```\nthis will shut down the master server.\n\n### Impact\nThis is a remote code execution on Wazuh server, affecting the latest version (v4.9.0 at this time)",
"id": "GHSA-hcrc-79hj-m3qh",
"modified": "2025-10-22T19:27:44Z",
"published": "2025-04-22T16:53:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24016"
},
{
"type": "PACKAGE",
"url": "https://github.com/wazuh/wazuh"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H/E:H",
"type": "CVSS_V3"
}
],
"summary": "Wazuh server vulnerable to remote code execution"
}
GHSA-HF23-9PF7-388P
Vulnerability from github – Published: 2019-07-26 16:09 – Updated: 2026-02-24 15:32It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.thoughtworks.xstream:xstream"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.10"
},
{
"fixed": "1.4.11"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.4.10"
]
}
],
"aliases": [
"CVE-2019-10173"
],
"database_specific": {
"cwe_ids": [
"CWE-502",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2019-07-25T10:11:50Z",
"nvd_published_at": "2019-07-23T13:15:00Z",
"severity": "CRITICAL"
},
"details": "It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)",
"id": "GHSA-hf23-9pf7-388p",
"modified": "2026-02-24T15:32:32Z",
"published": "2019-07-26T16:09:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10173"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3892"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4352"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0445"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0727"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173"
},
{
"type": "PACKAGE",
"url": "https://github.com/x-stream/xstream"
},
{
"type": "WEB",
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "http://x-stream.github.io/changes.html#1.4.11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Deserialization of Untrusted Data and Code Injection in xstream"
}
GHSA-HF4P-JM7R-VJJJ
Vulnerability from github – Published: 2019-07-26 16:10 – Updated: 2021-08-17 19:40An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.ethereum:ethereumj-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-15890"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2019-07-26T09:08:20Z",
"nvd_published_at": "2019-06-20T17:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.",
"id": "GHSA-hf4p-jm7r-vjjj",
"modified": "2021-08-17T19:40:00Z",
"published": "2019-07-26T16:10:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15890"
},
{
"type": "WEB",
"url": "https://github.com/ethereum/ethereumj/issues/1161"
},
{
"type": "WEB",
"url": "https://github.com/ethereum/ethereumj"
},
{
"type": "WEB",
"url": "https://github.com/frohoff/ysoserial"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Deserialization of Untrusted Data in EthereumJ"
}
GHSA-HFF6-MV2F-62RW
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2025-06-03 18:30The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps.
{
"affected": [],
"aliases": [
"CVE-2022-39008"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-16T18:15:00Z",
"severity": "CRITICAL"
},
"details": "The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps.",
"id": "GHSA-hff6-mv2f-62rw",
"modified": "2025-06-03T18:30:29Z",
"published": "2022-09-17T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39008"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2022/9"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-0000001392278845"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Mitigation
Explicitly define a final object() to prevent deserialization.
Mitigation
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Mitigation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
Mitigation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-586: Object Injection
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.