CVE-2015-3253
groovy: remote execution of untrusted code in class MethodClosure
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta).
Descripción
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all | 2.4.4 |
| debian 11 | groovy | 2.4.6-1 |
| debian 12 | groovy | 2.4.6-1 |
| debian 13 | groovy | 2.4.6-1 |
| debian 14 | groovy | 2.4.6-1 |
| debian 7 | groovy | 1.8.6-1+deb7u1 |
| debian 8 | groovy, groovy2 | 1.8.6-4+deb8u1 y 1 más |
| echo | groovy | 2.4.6-1 |
Mostrar las 10 entradas de 8 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.codehaus.groovy:groovy | 2.4.4 |
| maven::GitHub Security Advisory Maven | org.codehaus.groovy:groovy-all | 2.4.4 |
| debian 11 | groovy | 2.4.6-1 |
| debian 12 | groovy | 2.4.6-1 |
| debian 13 | groovy | 2.4.6-1 |
| debian 14 | groovy | 2.4.6-1 |
| debian 7 | groovy | 1.8.6-1+deb7u1 |
| debian 8 | groovy | 1.8.6-4+deb8u1 |
| debian 8 | groovy2 | 2.2.2+dfsg-3+deb8u1 |
| echo | groovy | 2.4.6-1 |
Referencias
- http://groovy-lang.org/security.html
- http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html
- http://rhn.redhat.com/errata/RHSA-2016-0066.html
- http://seclists.org/oss-sec/2015/q3/121
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Las 30 referencias
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/archive/1/536012/100/0/threaded
- http://www.securityfocus.com/bid/75919
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1034815
- http://www.zerodayinitiative.com/advisories/ZDI-15-365
- http://www.zerodayinitiative.com/advisories/ZDI-15-365/
- https://access.redhat.com/errata/RHSA-2016:1376
- https://access.redhat.com/errata/RHSA-2017:2486
- https://access.redhat.com/errata/RHSA-2017:2596
- https://access.redhat.com/security/cve/CVE-2015-3253
- https://github.com/apache/groovy
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
- https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2015-3253
- https://security.gentoo.org/glsa/201610-01
- https://security.netapp.com/advisory/ntap-20160623-0001
- https://security.netapp.com/advisory/ntap-20160623-0001/
- https://www.cve.org/CVERecord?id=CVE-2015-3253
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html