CVE-2022-37022
High
Description
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Apache Geode
PublishedAug 31, 2022
First seenAug 31, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- org.apache.geode:geode-core1.15.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache geode | v ≤ 1.12.2, 1.13.0 ≤ v ≤ 1.13.2 | — |
| org.apache.geode:geode-coreMaven | v < 1.15.0 | 1.15.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.