Date: Wed, 4 Dec 2019 06:28:45 +0100 From: mibo <mibo@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2019-17556: Olingo: Deserialization vulnerability CVE-2019-17556: Deserialization vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Olingo 4.0.0 to 4.6.0 The OData v2 versions of Olingo 2.x are not affected Description: The AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case. Mitigation: 4.x.x users should upgrade to 4.7.0 Credit: This issue was discovered by Artem Smotrakov of SAP SE. Links: https://issues.apache.org/jira/browse/OLINGO-1410
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.