[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 12 Nov 2015 23:50:56 -0500 (EST)
From: Jason Shepherd <jshepher@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Assign CVE for common-collections remote code execution on
deserialisation flaw
I think a precedent has been set with the Groovy issue [1] that we'd issue a CVE for the libraries that allow us to execute code during deserialization of their classes.
[1] CVE-2015-3253
As Gsunde points out, it would make it a lot easier for everyone to refer to this issue if it had a CVE.
----- Original Message -----
From: "Jason Shepherd" <jshepher@...hat.com>
To: oss-security@...ts.openwall.com
Sent: Monday, 9 November, 2015 10:36:20 AM
Subject: Assign CVE for common-collections remote code execution on deserialisation flaw
Hello oss-esc,
It was found that a flaw in Apache commons-collections Java library allowed remote code execution when Deserialised with Java Object Serialization. Full details of the vulnerability can be found in this recent blog post, [1]. A proposed patch for 3.2.x branch has been submitted upstream, but no release has been made with the fix at the current time. The issue affects version 3.x, and 4.x of Apache common-collections, [2].
[1] http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
[2] https://issues.apache.org/jira/browse/COLLECTIONS-580
Regards,
Jason Shepherd
Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
