[jira] [Closed] (GROOVY-7664) Deserializing Groovy objects results in arbitrary remote code execution

["Devin Rosenbauer (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/GROOVY-7664?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Devin Rosenbauer closed GROOVY-7664.
------------------------------------
       Resolution: Fixed
    Fix Version/s: 2.4.4

Disregard this, this was fixed in 2.4.4

> Deserializing Groovy objects results in arbitrary remote code execution
> -----------------------------------------------------------------------
>
>                 Key: GROOVY-7664
>                 URL: https://issues.apache.org/jira/browse/GROOVY-7664
>             Project: Groovy
>          Issue Type: Bug
>          Components: groovy-runtime
>    Affects Versions: 2.4.5
>            Reporter: Devin Rosenbauer
>            Priority: Critical
>              Labels: security, serialization, vulnerability
>             Fix For: 2.4.4
>
>
> A specific object structure of Groovy objects can be used to run arbitrary commands remotely via unchecked deserialization. See issue COLLECTIONS-580 for a related problem in another library.
> See the following links for details:
> http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
> The payload-building code:
> https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/Groovy1.java



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)