CVE-2016-10750: High severity hazelcast vulnerability
A flaw was found in the cluster join procedure in Hazelcast. This flaw allows an attacker to gain remote code execution via Java deserialization.
Other sources
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization.
Upstream issue:
https://github.com/hazelcast/hazelcast/issues/8024
Upstream pull:
https://github.com/hazelcast/hazelcast/pull/12230
— Red Hat
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10750?
CVE-2016-10750 has a critical severity level due to its potential for remote code execution.
How do I fix CVE-2016-10750?
To fix CVE-2016-10750, upgrade Hazelcast to version 3.11 or higher.
What type of vulnerability is CVE-2016-10750?
CVE-2016-10750 is a remote code execution vulnerability caused by unsafe Java deserialization during the cluster join procedure.
Which versions of Hazelcast are affected by CVE-2016-10750?
Hazelcast versions prior to 3.11 are affected by CVE-2016-10750.
Can CVE-2016-10750 be exploited remotely?
Yes, CVE-2016-10750 can be exploited remotely, allowing attackers to execute arbitrary code.