CVE-2016-0779: Critical severity apache tomee vulnerability
Published Apr 11, 2017
·Updated
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
Affected Software
2 affected components
Apache TomEE<=1.7.3
Apache TomEE=7.0.0-m1
Remediation
Patch Available
Event History
Apr 11, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-0779?
CVE-2016-0779 is considered a critical vulnerability as it allows remote code execution through crafted serialized objects.
2
How do I fix CVE-2016-0779?
To fix CVE-2016-0779, upgrade Apache TomEE to version 1.7.4 or 7.0.0-M3 or later.
3
Who is affected by CVE-2016-0779?
CVE-2016-0779 affects users of Apache TomEE versions prior to 1.7.4 and specific 7.x versions before 7.0.0-M3.
4
What is the impact of CVE-2016-0779?
The impact of CVE-2016-0779 includes unauthorized remote access and execution of arbitrary code, potentially compromising system integrity.
5
What versions of Apache TomEE are vulnerable to CVE-2016-0779?
Apache TomEE versions 1.7.3 and earlier, as well as 7.0.0-M1, are vulnerable to CVE-2016-0779.