Vulnerability Description
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Groovy | >= 1.7.0, <= 2.4.3 |
| Redhat | Enterprise Linux Server | 7.0 |
Related Weaknesses (CWE)
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hPatchVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0272.htmlBroken Link
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/95429Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039600Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:0868Broken Link
- https://access.redhat.com/errata/RHSA-2017:2486Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2596Third Party Advisory
- https://security.gentoo.org/glsa/202003-01
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
FAQ
What is CVE-2016-6814?
CVE-2016-6814 is a vulnerability with a CVSS score of 9.8 (CRITICAL). When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between...
How severe is CVE-2016-6814?
CVE-2016-6814 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-6814?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Groovy, Redhat Enterprise Linux Server.