[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAGSZ4d6Zo5jLuPJJ+2XsBX5Ji7kRCxruqxVE8LcqLV=VhQmXiQ@mail.gmail.com>
Date: Wed, 4 Dec 2019 06:28:45 +0100
From: mibo <mibo@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-17556: Olingo: Deserialization vulnerability
CVE-2019-17556: Deserialization vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Olingo 4.0.0 to 4.6.0
The OData v2 versions of Olingo 2.x are not affected
Description:
The AbstractService class, which is public API, uses ObjectInputStream
and doesn't check classes being deserialized. If an attacker can feed
malicious metadata to the class, then it may result in running
attacker's code in the worse case.
Mitigation:
4.x.x users should upgrade to 4.7.0
Credit:
This issue was discovered by Artem Smotrakov of SAP SE.
Links:
https://issues.apache.org/jira/browse/OLINGO-1410
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
