CVE-2016-6814in critical feed
Deserialization of Untrusted Data in Groovy
Also known as GHSA-xphj-m9cc-8fmq
Published 8 y ago · modified 4 mo ago · JSON
Summary
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
Exploit prediction (EPSS)
17.24% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.codehaus.groovy:groovy | >=1.7.0, <2.4.8 | 2.4.8 |
| maven | org.codehaus.groovy:groovy-all | >=1.7.0, <2.4.8 | 2.4.8 |
Classification
- Weakness
- CWE-502 Deserialization of Untrusted Data
References
- access.redhat.com /errata/RHSA-2017:2596 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:0868 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:2486 · vendor-advisory, x_refsource_REDHAT, x_transferred
- rhn.redhat.com /errata/RHSA-2017-0272.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/95429 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1039600 · vdb-entry, x_refsource_SECTRACK, x_transferred
- security.gentoo.org /glsa/202003-01 · vendor-advisory, x_refsource_GENTOO, x_transferred
- oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
- oracle.com /technetwork/security-advisory/cpuapr2018-3678067.html · x_refsource_CONFIRM, x_transferred
- oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
- oracle.com /security-alerts/cpujul2020.html · x_refsource_MISC, x_transferred
- oracle.com /technetwork/security-advisory/cpujan2019-5072801.html · x_refsource_CONFIRM, x_transferred
- oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred
- oracle.com /technetwork/security-advisory/cpuoct2019-5072832.html · x_refsource_MISC, x_transferred
- oracle.com /security-alerts/cpujan2020.html · x_refsource_MISC, x_transferred
- mail-archives.apache.org /mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA% · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-6814 · advisory
Sources
- CVE List: CVE-2016-6814
- GitHub Advisory: GHSA-xphj-m9cc-8fmq
- NVD: CVE-2016-6814
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.