CVE-2019-17556: Olingo: Deserialization vulnerability

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
CVE-2019-17556: Olingo: Deserialization vulnerability

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: mibo &lt;mibo () apache org&gt;

Date: Wed, 4 Dec 2019 06:28:45 +0100

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
CVE-2019-17556: Deserialization vulnerability

Severity: Important
Vendor: The Apache Software Foundation

Versions Affected:
Olingo 4.0.0 to 4.6.0
The OData v2 versions of Olingo 2.x are not affected

Description:
The AbstractService class, which is public API, uses ObjectInputStream
and doesn't check classes being deserialized. If an attacker can feed
malicious metadata to the class, then it may result in running
attacker's code in the worse case.

Mitigation:
4.x.x users should upgrade to 4.7.0

Credit:
This issue was discovered by Artem Smotrakov of SAP SE.

Links:
https://issues.apache.org/jira/browse/OLINGO-1410

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2019-17556: Olingo: Deserialization vulnerability mibo (Dec 04)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->