https://bugzilla.redhat.com/show_bug.cgi?id=1413466
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70114,reported=20170112,sou |70114,reported=20170112,sou
|rce=internet,cvss3=9.6/CVSS |rce=internet,cvss3=9.6/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:R/S: |:3.0/AV:N/AC:L/PR:N/UI:R/S:
|C/C:H/I:H/A:H,amq-6/groovy= |C/C:H/I:H/A:H,amq-6/groovy=
|affected,jdv-6/groovy=affec |affected,jdv-6/groovy=affec
|ted/cvss3=8.3/CVSS:3.0/AV:N |ted/impact=moderate/cvss3=8
|/AC:H/PR:N/UI:R/S:C/C:H/I:H |.3/CVSS:3.0/AV:N/AC:H/PR:N/
|/A:H/impact=moderate,eap-5/ |UI:R/S:C/C:H/I:H/A:H,eap-5/
|groovy=wontfix,brms-5/groov |groovy=wontfix,brms-5/groov
|y=wontfix,soap-5/groovy=won |y=wontfix,soap-5/groovy=won
|tfix,eds-5/groovy=wontfix,f |tfix,eds-5/groovy=wontfix,f
|sw-6/camel=affected,fuse-6/ |sw-6/camel=affected,fuse-6/
|camel=affected,jon-3/groovy |camel=affected,jon-3/groovy
|=notaffected,epp-5/groovy=n |=notaffected,epp-5/groovy=n
|ew,openshift-enterprise-2/j |ew,openshift-enterprise-2/j
|enkins=new,rhev-m-3/jasperr |enkins=new,rhev-m-3/jasperr
|eports-server-pro=new,rhel- |eports-server-pro=new,rhel-
|7/groovy=new,rhn_satellite_ |7/groovy=new,rhn_satellite_
|6/groovy=new,rhscl-2/rh-mav |6/groovy=new,rhscl-2/rh-mav
|en33-groovy=new,fedora-all/ |en33-groovy=new,fedora-all/
|groovy=affected,fedora-all/ |groovy=affected,fedora-all/
|groovy18=affected |groovy18=affected
--- Comment #12 from Hooman Broujerdi <hghasemb(a)redhat.com> ---
Apache groovy prior to 2.4.8 allows a desrialization via methodClosure which
could allow desrialization of untrusted data.
Currently all versions prior to 2.4.8 are affected and the mitigation is to
update to versions >= 2.4.8.
JBoss fuse has fixed this issue as a part of 6.3 R3.
--
You are receiving this mail because:
You are on the CC list for the bug.