CVE-2016-6814
Summary
| CVE | CVE-2016-6814 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-01-18 18:29:00 UTC |
| Updated | 2020-07-15 03:15:00 UTC |
| Description | When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Groovy | All | All | All | All |
| Application | Apache | Groovy | All | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Oracle Critical Patch Update Advisory - July 2020 | MISC | www.oracle.com | |
| Apache Groovy CVE-2016-6814 Remote Code Execution Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Groovy: Arbitrary code execution (GLSA 202003-01) — Gentoo security | GENTOO | security.gentoo.org | |
| CPU July 2018 | CONFIRM | www.oracle.com | |
| Oracle Critical Patch Update - April 2018 | CONFIRM | www.oracle.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Broken Link |
| Oracle Critical Patch Update - January 2019 | CONFIRM | www.oracle.com | |
| Oracle Critical Patch Update - July 2019 | MISC | www.oracle.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Broken Link |
| Oracle Enterprise Manager Ops Center Networking Flaw Lets Remote Users Gain Elevated Privileges - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| CPU Oct 2018 | CONFIRM | www.oracle.com | |
| Oracle Critical Patch Update - October 2019 | MISC | www.oracle.com | |
| Oracle Critical Patch Update Advisory - January 2020 | MISC | www.oracle.com | |
| [CVE-2016-6814] Apache Groovy Information Disclosure | MISC | mail-archives.apache.org | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.