CVE-2015-7501: Critical severity redhat Data Grid vulnerability
It was found that a flaw in commons-collection library allowed remote code execution wherever deserialization occurs. While JBoss doesnt expose the JMXInvokerServlet by default, other interfaces where deserialization occur might be vulnerable.
Note: classes directly referenced by this flaw: InvokerTransformer, InstantiateFactory, and InstantiateTransformer
External References:
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ https://access.redhat.com/solutions/2045023
Other sources
It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7501?
CVE-2015-7501 has a high severity rating as it can lead to remote code execution due to deserialization issues in the commons-collection library.
How do I fix CVE-2015-7501?
To fix CVE-2015-7501, update to commons-collections version 3.2.2 or later, or to commons-collections4 version 4.1 or later.
Which software is affected by CVE-2015-7501?
CVE-2015-7501 affects software using specific versions of the commons-collections library, including Apache ServiceMix and Red Hat JBoss products.
What exploits are associated with CVE-2015-7501?
CVE-2015-7501 can be exploited via remote code execution, especially through vulnerable deserialization mechanisms.
Is CVE-2015-7501 fixed in newer versions?
Yes, CVE-2015-7501 is fixed in versions of commons-collections starting from 3.2.2 and 4.1 onwards.