High severity · published Aug 31, 2022
CVE-2022-37022
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geode · Apache
through 1.12.2; 1.13.0 through 1.13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37022
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37022
Mailing List
https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4m
More from Geode
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
7.8
CVE-2019-15752
Docker Desktop Community Edition Privilege Escalation Vulnerability
9.8
CVE-2022-37021
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8
9.8
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using…
9.8
CVE-2014-0048
An issue was found in Docker before 1.6.0