oss-sec mailing list archives
Re: Assign CVE for common-collections remote code execution on deserialisation flaw
From: Jason Shepherd <jshepher () redhat com>
Date: Thu, 12 Nov 2015 23:50:56 -0500 (EST)
I think a precedent has been set with the Groovy issue [1] that we'd issue a CVE for the libraries that allow us to execute code during deserialization of their classes. [1] CVE-2015-3253 As Gsunde points out, it would make it a lot easier for everyone to refer to this issue if it had a CVE. ----- Original Message ----- From: "Jason Shepherd" <jshepher () redhat com> To: oss-security () lists openwall com Sent: Monday, 9 November, 2015 10:36:20 AM Subject: Assign CVE for common-collections remote code execution on deserialisation flaw Hello oss-esc, It was found that a flaw in Apache commons-collections Java library allowed remote code execution when Deserialised with Java Object Serialization. Full details of the vulnerability can be found in this recent blog post, [1]. A proposed patch for 3.2.x branch has been submitted upstream, but no release has been made with the fix at the current time. The issue affects version 3.x, and 4.x of Apache common-collections, [2]. [1] http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ [2] https://issues.apache.org/jira/browse/COLLECTIONS-580 Regards, Jason Shepherd Red Hat Product Security
Current thread:
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw, (continued)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Gsunde Orangen (Nov 12)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Mark Felder (Nov 13)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Lisa Bradley (Nov 13)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Gsunde Orangen (Nov 13)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Oracle Security Alerts (Thomas) (Nov 17)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Mark Felder (Nov 13)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Gsunde Orangen (Nov 13)
- Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw Gsunde Orangen (Nov 15)
- Re: Re: Assign CVE for common-collections remote code execution on deserialisation flaw Gsunde Orangen (Nov 13)