CVE-2016-6814
Critical
Description
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Groovy
PublishedJan 18, 2018
First seenJan 18, 2018
How to fix
Update
- org.codehaus.groovy:groovy2.4.8 or later
- org.codehaus.groovy:groovy-all2.4.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache groovy | 1.7.0 ≤ v ≤ 2.4.3, 2.4.4 ≤ v ≤ 2.4.7 | — |
| redhat enterprise_linux_server | 7.0 | — |
| org.codehaus.groovy:groovyMaven | 1.7.0 ≤ v < 2.4.8 | 2.4.8 |
| org.codehaus.groovy:groovy-allMaven | 1.7.0 ≤ v < 2.4.8 | 2.4.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.