CVE-2022-37021: Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-37021?
CVE-2022-37021 is a vulnerability in Apache Geode versions up to 1.12.5, 1.13.4, and 1.14.0 that allows for the deserialization of untrusted data when using JMX over RMI on Java 8.
How severe is CVE-2022-37021?
CVE-2022-37021 is rated as critical with a severity score of 9.8.
What software versions are affected by CVE-2022-37021?
Apache Geode versions up to 1.12.5, 1.13.4, and 1.14.0 are affected by CVE-2022-37021.
How can I protect against CVE-2022-37021?
To protect against CVE-2022-37021, it is recommended to upgrade to Apache Geode 1.15 and use Java 11.
Where can I find more information about CVE-2022-37021?
For more information about CVE-2022-37021, you can refer to the following link: [https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr](https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr)