CVE-2018-1295: Apache serialization mechanism does not… – CVSS 9.8 · Watchpost

← 脆弱性一覧

Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization

緊急 9.8CVE-2018-1295 · GHSA-chp4-rv79-68j3 · 02/04/2018 公開 · 17/06/2026 更新

要点

CVE-2018-1295 は org.apache.ignite:ignite-core, ignite (apache) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：6.3%（全脆弱性の 93.6% より高い）。
対処：2.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.ignite:ignite-core Maven	`< 2.4`	`2.4`
ignite apache	`≤ 2.3.0`	修正版なし

概要

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.

NVD の説明

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.

参考情報

nvd.nist.gov/vuln/detail/CVE-2018-1295 · ADVISORY
access.redhat.com/errata/RHSA-2018:2405 · WEB
GitHub Advisory GHSA-chp4-rv79-68j3 · ADVISORY
apache/ignite · PACKAGE
lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209@%3Cdev.ignite.apache.org%3E · WEB
web.archive.org/web/20200227125559/http://www.securityfocus.com/bid/103692 · WEB
securityfocus.com/bid/103692 · Third Party Advisory
lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209%40%3Cdev.ignite.apache.org%3E

org.apache.ignite:ignite-core のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン