org.apache.geode:geode-core
Maven17 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.apache.geode:geode-corepage 1 of 1
- CVE-2017-12622HIGHCVSS 7.1EG 7.1fixed in 1.3.02018-01-10
vulnerable: 1.0.0-incubating ... 1.2.1 (7 versions)
When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even with…
- CVE-2017-15692CRITICALCVSS 9.8EG 9.8fixed in 1.4.02018-02-27
vulnerable: 1.0.0-incubating ... 1.3.0 (8 versions)
In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classe…
- CVE-2017-15693HIGHCVSS 7.5EG 7.5fixed in 1.4.02018-02-27
vulnerable: 1.0.0-incubating ... 1.3.0 (8 versions)
In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able …
- CVE-2017-15694MEDIUMCVSS 6.5EG 6.5fixed in 1.9.02019-06-21
vulnerable: 1.0.0-incubating ... 1.8.0 (13 versions)
When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects th…
- CVE-2017-15695HIGHCVSS 8.8EG 8.8fixed in 1.5.02018-06-13
vulnerable: 1.0.0-incubating ... 1.4.0 (9 versions)
When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployme…
- CVE-2017-15696HIGHCVSS 7.5EG 7.5fixed in 1.4.02018-02-26
vulnerable: 1.0.0-incubating ... 1.3.0 (8 versions)
When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract c…
- CVE-2017-5649HIGHCVSS 7.5EG 7.5fixed in 1.1.12017-04-04
vulnerable: 1.1.0
Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and conseque…
- CVE-2017-9794MEDIUMCVSS 4.3EG 4.3fixed in 1.2.12017-09-30
vulnerable: 1.0.0-incubating ... 1.2.0 (6 versions)
When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user'…
- CVE-2017-9795HIGHCVSS 7.5EG 7.5fixed in 1.3.02018-01-10
vulnerable: 1.0.0-incubating ... 1.2.1 (7 versions)
When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In …
- CVE-2017-9796MEDIUMCVSS 5.3EG 5.3fixed in 1.3.02018-01-10
vulnerable: 1.0.0-incubating ... 1.2.1 (7 versions)
When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objec…
- CVE-2017-9797MEDIUMCVSS 6.5EG 6.5fixed in 1.2.12017-10-03
vulnerable: 1.0.0-incubating ... 1.2.0 (6 versions)
When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data …
- CVE-2019-10091HIGHCVSS 7.4EG 7.4fixed in 1.10.02020-03-16
vulnerable: 1.0.0-incubating ... 1.9.2 (16 versions)
When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication…
- CVE-2021-34797HIGHCVSS 7.5EG 7.5fixed in 1.12.5 or 1.13.5, by version range2022-01-04
vulnerable: 1.13.0, 1.13.1, 1.13.2, 1.13.3, 1.13.4
Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the pr…
- CVE-2022-34870MEDIUMCVSS 5.4EG 5.4fixed in 1.15.12022-10-25
vulnerable: 1.0.0-incubating ... 1.9.2 (43 versions)
Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
- CVE-2022-37021CRITICALCVSS 9.8EG 9.8fixed in 1.12.16, 1.13.5 or 1.14.1, by version range2022-08-31
vulnerable: 1.14.0
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JM…
- CVE-2022-37022HIGHCVSS 8.8EG 8.8fixed in 1.15.02022-08-31
vulnerable: 1.0.0-incubating ... 1.9.2 (42 versions)
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to…
- CVE-2022-37023MEDIUMCVSS 6.5EG 6.5fixed in 1.15.02022-08-31
vulnerable: 1.0.0-incubating ... 1.9.2 (42 versions)
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Ap…
Check whether org.apache.geode:geode-core is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.apache.geode:geode-core CVEs against the assets you own.
Book a Demo →