crítica
CVE-2016-6814
Groovy: Remote code execution via deserialization
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Oracle (alta), Ubuntu (media).
Descripción
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all | 2.4.8 |
| debian 11 | groovy | 2.4.8-1 |
| debian 12 | groovy | 2.4.8-1 |
| debian 13 | groovy | 2.4.8-1 |
| debian 14 | groovy | 2.4.8-1 |
| debian 7 | groovy | 1.8.6-1+deb7u2 |
| debian 8 | groovy, groovy2 | 1.8.6-4+deb8u2 y 1 más |
| echo | groovy | 2.4.8-1 |
| Oracle Linux 7 | groovy, groovy-javadoc | 1.8.9-8.el7_4 |
| ubuntu 16.04-ESM | groovy2 | 2.4.5-1ubuntu0.1~esm1 |
Mostrar las 13 entradas de 10 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.codehaus.groovy:groovy | 2.4.8 |
| maven::GitHub Security Advisory Maven | org.codehaus.groovy:groovy-all | 2.4.8 |
| debian 11 | groovy | 2.4.8-1 |
| debian 12 | groovy | 2.4.8-1 |
| debian 13 | groovy | 2.4.8-1 |
| debian 14 | groovy | 2.4.8-1 |
| debian 7 | groovy | 1.8.6-1+deb7u2 |
| debian 8 | groovy | 1.8.6-4+deb8u2 |
| debian 8 | groovy2 | 2.2.2+dfsg-3+deb8u2 |
| echo | groovy | 2.4.8-1 |
| Oracle Linux 7 | groovy | 1.8.9-8.el7_4 |
| Oracle Linux 7 | groovy-javadoc | 1.8.9-8.el7_4 |
| ubuntu 16.04-ESM | groovy2 | 2.4.5-1ubuntu0.1~esm1 |
Referencias
- http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA@mail.gmail.com%3E
- http://rhn.redhat.com/errata/RHSA-2017-0272.html
- http://www.openwall.com/lists/oss-security/2017/01/14/3
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/95429
- http://www.securitytracker.com/id/1039600
Las 23 referencias
- https://access.redhat.com/errata/RHSA-2017:0868
- https://access.redhat.com/errata/RHSA-2017:2486
- https://access.redhat.com/errata/RHSA-2017:2596
- https://access.redhat.com/security/cve/CVE-2016-6814
- https://linux.oracle.com/cve/CVE-2016-6814.html
- https://linux.oracle.com/errata/ELSA-2017-2486.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-6814
- https://security.gentoo.org/glsa/202003-01
- https://ubuntu.com/security/notices/USN-4795-1
- https://www.cve.org/CVERecord?id=CVE-2016-6814
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html