oss-sec mailing list archives
CVE-2019-17556: Olingo: Deserialization vulnerability
From: mibo <mibo () apache org>
Date: Wed, 4 Dec 2019 06:28:45 +0100
CVE-2019-17556: Deserialization vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Olingo 4.0.0 to 4.6.0 The OData v2 versions of Olingo 2.x are not affected Description: The AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case. Mitigation: 4.x.x users should upgrade to 4.7.0 Credit: This issue was discovered by Artem Smotrakov of SAP SE. Links: https://issues.apache.org/jira/browse/OLINGO-1410
Current thread:
- CVE-2019-17556: Olingo: Deserialization vulnerability mibo (Dec 04)