CVE-2022-37023CWE-502

Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11

published August 31, 2022

CVSS
—
EPSS
2%
Percentile
76.6
In the wild
Unconfirmed
What it is

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01671 · 76.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2022-08-31T07:00Z
EPSS history
Timeline
  • 31 AUG 07:00Z
    Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11
    cvelistv5