CVE-2018-1295
First published: Mon Apr 02 2018(Updated: )
In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Ignite | <=2.3.0 | |
| redhat/ignite | <2.4 | 2.4 |
| maven/org.apache.ignite:ignite-core | <2.4 | 2.4 |
| <=2.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/103692
- https://access.redhat.com/errata/RHSA-2018:2405
- https://lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209@%3Cdev.ignite.apache.org%3E
- https://bugzilla.redhat.com/show_bug.cgi?id=1563133
- https://nvd.nist.gov/vuln/detail/CVE-2018-1295
- https://github.com/advisories/GHSA-chp4-rv79-68j3 (Advisory)
- https://web.archive.org/web/20200227125559/http://www.securityfocus.com/bid/103692
- https://lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209%40%3Cdev.ignite.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2018-1295?
The severity of CVE-2018-1295 is critical with a severity value of 9.8.
How does Apache Ignite 2.3 or earlier serialization mechanism vulnerability work?
The vulnerability in Apache Ignite 2.3 or earlier allows running arbitrary code when vulnerable classes are present in Ignite classpath.
What software versions are affected by CVE-2018-1295?
Apache Ignite versions up to and including 2.3.0 are affected by CVE-2018-1295.
How can I fix the CVE-2018-1295 vulnerability?
To fix the vulnerability, upgrade Apache Ignite to version 2.4 or later.
Where can I find more information about CVE-2018-1295?
More information about CVE-2018-1295 can be found at the following references: [Link 1](https://lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209@%3Cdev.ignite.apache.org%3E), [Link 2](https://access.redhat.com/errata/RHSA-2018:2405), [Link 3](https://bugzilla.redhat.com/show_bug.cgi?id=1563133).
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-1295
- agent/software-canonical-lookup
- agent/weakness
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-chp4-rv79-68j3
- agent/last-modified-date
- agent/severity
- agent/references
- agent/tags
- agent/softwarecombine
- agent/author
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- vendor/apache
- canonical/apache ignite
- version/apache ignite/2.3.0
- package-manager/redhat
- package-manager/maven