CVE-2016-6814
At a glance
- Source
- NVD
- EPSS
- EPSS 17.24 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
Weaknesses (CWE)
- CWE-502 — Deserialization of Untrusted Data
References
- https://access.redhat.com/errata/RHSA-2017:2596
- https://access.redhat.com/errata/RHSA-2017:0868
- https://access.redhat.com/errata/RHSA-2017:2486
- http://rhn.redhat.com/errata/RHSA-2017-0272.html
- http://www.securityfocus.com/bid/95429
- http://www.securitytracker.com/id/1039600
- https://security.gentoo.org/glsa/202003-01
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-xphj-m9cc-8fmq — Deserialization of Untrusted Data in Groovy
European references
- ENISA EUVD · EUVD-2022-5835
- GCVE · GCVE-0-2016-6814
CERT-FR advisories
- CERTFR-2017-AVI-371 — Multiples vulnérabilités dans Oracle VM Server pour x86 et Oracle Linux · cert.ssi.gouv.fr
- CERTFR-2017-AVI-370 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*≥ 1.7.0 ≤ 2.4.3cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*≥ 2.4.4 ≤ 2.4.7cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |