Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2026-27727

kritik

CVE-2026-27727

com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects

Yayın Değişiklik CWE 74, 502
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Red Hat8.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (yüksek), Ubuntu (orta).

Açıklama

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
chainguarddebezium-3.3, debezium-3.4, hono ve 2 tane daha3.3.2-r2 ve 4 tane daha
echo maven::Echo OSVcom.mchange:mchange-commons-java0.4.0
maven::GitHub Security Advisory Mavencom.mchange:mchange-commons-java0.4.0
Red Hatcandlepin, candlepin-selinux, satellite:el8::candlepin ve 1 tane dahadüzeltme belirtilmemiş
ubuntu 18.04-ESMc3p00.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1
ubuntu 20.04-ESMc3p00.9.1.2-10ubuntu0.20.04.1+esm1
ubuntu 22.04c3p0düzeltme belirtilmemiş
ubuntu 24.04c3p0düzeltme belirtilmemiş
ubuntu 26.04c3p0düzeltme belirtilmemiş
ubuntu 26.10c3p0düzeltme belirtilmemiş
wolfidebezium-3.43.4.2-r0
11 kaynaktaki 18 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
chainguarddebezium-3.33.3.2-r2
chainguarddebezium-3.43.4.2-r0
chainguardhono2.7.0-r1
chainguardsolr-99.10.1-r14
chainguardsolr-fips-99.10.1-r3
echo maven::Echo OSVcom.mchange:mchange-commons-java0.4.0
maven::GitHub Security Advisory Mavencom.mchange:mchange-commons-java0.4.0
Red Hatcandlepindüzeltme belirtilmemiş
Red Hatcandlepin-selinuxdüzeltme belirtilmemiş
Red Hatsatellite:el8::candlepindüzeltme belirtilmemiş
Red Hatsatellite:el8::candlepin-selinuxdüzeltme belirtilmemiş
ubuntu 18.04-ESMc3p00.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1
ubuntu 20.04-ESMc3p00.9.1.2-10ubuntu0.20.04.1+esm1
ubuntu 22.04c3p0düzeltme belirtilmemiş
ubuntu 24.04c3p0düzeltme belirtilmemiş
ubuntu 26.04c3p0düzeltme belirtilmemiş
ubuntu 26.10c3p0düzeltme belirtilmemiş
wolfidebezium-3.43.4.2-r0

Referanslar

21 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.