CVE-2017-5641

 

Published at: - 28-12-2017 04:29

Last modified: - 19-04-2022 06:06

Total changes: - 3

Description

Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• VU#307983-Third Party Advisory, US Government Resource
• https://issues.apache.org/jira/browse/FLEX-35290
• [flex-dev] 20170327 [VOTE] Release Apache Flex BlazeDS 4.7.3-Mailing List, Patch, Vendor Advisory
• 1038273-Broken Link
• 97383-Broken Link
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03823en_us
• https://www.zerodayinitiative.com/advisories/ZDI-22-507/
• https://www.zerodayinitiative.com/advisories/ZDI-22-506/

 

Keywords

NVD

 

CVE-2017-5641

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures