cnvd - cnvd-2022-83596

cnvd-2022-83596

Vulnerability from cnvd

Title: Apache Geode远程代码执行漏洞

Description:

Apache Geode是美国阿帕奇（Apache）基金会的一套应用于分布式云架构中提供对数据密集型应用程序实时和一致访问数据的管理平台。

Apache Geode存在远程代码执行漏洞，该漏洞源于容易受到不可信数据反序列化缺陷的影响。攻击者可利用该漏洞造成远程代码执行。

Severity: 高

Patch Name: Apache Geode远程代码执行漏洞的补丁

Patch Description:

Apache Geode是美国阿帕奇（Apache）基金会的一套应用于分布式云架构中提供对数据密集型应用程序实时和一致访问数据的管理平台。

Apache Geode 1.12.5、1.13.4 和 1.14.0之前版本存在远程代码执行漏洞，该漏洞源于容易受到不可信数据反序列化缺陷的影响。攻击者可利用该漏洞造成远程代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.openwall.com/lists/oss-security/2022/08/30/3

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-37021

Impacted products

Name
['Apache Geode >=1.13.0，<=1.13.4', 'Apache Geode <=1.12.5', 'Apache Geode 1.14.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-37021",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-37021"
    }
  },
  "description": "Apache Geode\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5e94\u7528\u4e8e\u5206\u5e03\u5f0f\u4e91\u67b6\u6784\u4e2d\u63d0\u4f9b\u5bf9\u6570\u636e\u5bc6\u96c6\u578b\u5e94\u7528\u7a0b\u5e8f\u5b9e\u65f6\u548c\u4e00\u81f4\u8bbf\u95ee\u6570\u636e\u7684\u7ba1\u7406\u5e73\u53f0\u3002\n\nApache Geode\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bb9\u6613\u53d7\u5230\u4e0d\u53ef\u4fe1\u6570\u636e\u53cd\u5e8f\u5217\u5316\u7f3a\u9677\u7684\u5f71\u54cd\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.openwall.com/lists/oss-security/2022/08/30/3",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-83596",
  "openTime": "2023-01-12",
  "patchDescription": "Apache Geode\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u5e94\u7528\u4e8e\u5206\u5e03\u5f0f\u4e91\u67b6\u6784\u4e2d\u63d0\u4f9b\u5bf9\u6570\u636e\u5bc6\u96c6\u578b\u5e94\u7528\u7a0b\u5e8f\u5b9e\u65f6\u548c\u4e00\u81f4\u8bbf\u95ee\u6570\u636e\u7684\u7ba1\u7406\u5e73\u53f0\u3002\r\n\r\nApache Geode 1.12.5\u30011.13.4 \u548c 1.14.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bb9\u6613\u53d7\u5230\u4e0d\u53ef\u4fe1\u6570\u636e\u53cd\u5e8f\u5217\u5316\u7f3a\u9677\u7684\u5f71\u54cd\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Geode\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Geode \u003e=1.13.0\uff0c\u003c=1.13.4",
      "Apache Geode \u003c=1.12.5",
      "Apache Geode 1.14.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-37021",
  "serverity": "\u9ad8",
  "submitTime": "2022-09-01",
  "title": "Apache Geode\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2022-37021 (GCVE-0-2022-37021)

Vulnerability from cvelistv5

Published

2022-08-31 07:00

Modified

2024-08-03 10:21

Severity ?

CWE

CWE-502 - Deserialization of Untrusted Data

Summary

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.

References

▼	URL	Tags
	https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Geode	Version: Apache Geode <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:21:32.657Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Java 8"
          ],
          "product": "Apache Geode",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.12.5",
              "status": "affected",
              "version": "Apache Geode",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify \"--J=-Dgeode.enableGlobalSerialFilter=true\" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the \"serializable-object-filter\" configuration option. Using a global serial filter will impact performance."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "high - possible RCE"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-31T07:00:14",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr"
        }
      ],
      "source": {
        "defect": [
          "GEODE-9758"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. ",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable affected services such as JMX over RMI unless they are required. JMX over RMI can be disabled by setting Geode property `jmx-manager` to false; this property defaults to false on Servers and true on Locators. "
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-37021",
          "STATE": "PUBLIC",
          "TITLE": "Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. "
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Geode",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Java 8",
                            "version_affected": "\u003c=",
                            "version_name": "Apache Geode",
                            "version_value": "1.12.5"
                          },
                          {
                            "platform": "Java 8",
                            "version_affected": "\u003c=",
                            "version_name": "Apache Geode",
                            "version_value": "1.13.4 +1"
                          },
                          {
                            "platform": "Java 8",
                            "version_affected": "\u003c=",
                            "version_name": "Apache Geode",
                            "version_value": "1.14.0 +1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify \"--J=-Dgeode.enableGlobalSerialFilter=true\" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the \"serializable-object-filter\" configuration option. Using a global serial filter will impact performance."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "high - possible RCE"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502 Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr"
            }
          ]
        },
        "source": {
          "defect": [
            "GEODE-9758"
          ],
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Disable affected services such as JMX over RMI unless they are required. JMX over RMI can be disabled by setting Geode property `jmx-manager` to false; this property defaults to false on Servers and true on Locators. "
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-37021",
    "datePublished": "2022-08-31T07:00:14",
    "dateReserved": "2022-07-29T00:00:00",
    "dateUpdated": "2024-08-03T10:21:32.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted