A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.
Find out more about CVE-2015-3253 from the MITRE CVE dictionary dictionary and NIST NVD.
| Base Score | 6.8 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
| CVSS3 Base Score | 9.6 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | High |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (rh-maven33-groovy) | RHSA-2017:2596 | 2017-09-05 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (rh-maven33-groovy) | RHSA-2017:2596 | 2017-09-05 |
| Red Hat Enterprise Linux 7 (groovy) | RHSA-2017:2486 | 2017-08-17 |
| Platform | Package | State |
|---|---|---|
| Red Hat OpenShift Enterprise 2 | jenkins | Will not fix |
| Red Hat JBoss Portal Platform 6 | groovy-all | Affected |
| Red Hat JBoss Operations Network 3 | groovy-all | Affected |
| Red Hat JBoss Fuse Service Works 6 | groovy-all | Affected |
| Red Hat JBoss Enterprise SOA Platform 5 | grovy-all | Affected |
| Red Hat JBoss Enterprise SOA Platform 4 | groovy-all | Will not fix |
| Red Hat JBoss EAP 5 | groovy-all | Will not fix |
| Red Hat JBoss Data Virtualization 6 | groovy-all | Affected |
| Red Hat JBoss BRMS 5 | groovy-all | Will not fix |
| Red Hat JBoss BPMS 6 | groovy-all | Not affected |
| RHEV Manager 3 | jasperreports-server-pro | Affected |
Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):
public class MethodClosure extends Closure {
+ private Object readResolve() {
+ throw new UnsupportedOperationException();
+
}
Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.
Vulmon