CVE-2022-37021: Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.
First published: Wed Aug 31 2022(Updated: )
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Geode | <=1.12.5 | |
| Apache Geode | >=1.13.0<=1.13.4 | |
| Apache Geode | =1.14.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-37021?
CVE-2022-37021 is a vulnerability in Apache Geode versions up to 1.12.5, 1.13.4, and 1.14.0 that allows for the deserialization of untrusted data when using JMX over RMI on Java 8.
How severe is CVE-2022-37021?
CVE-2022-37021 is rated as critical with a severity score of 9.8.
What software versions are affected by CVE-2022-37021?
Apache Geode versions up to 1.12.5, 1.13.4, and 1.14.0 are affected by CVE-2022-37021.
How can I protect against CVE-2022-37021?
To protect against CVE-2022-37021, it is recommended to upgrade to Apache Geode 1.15 and use Java 11.
Where can I find more information about CVE-2022-37021?
For more information about CVE-2022-37021, you can refer to the following link: [https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr](https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/severity
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/apache
- canonical/apache geode
- version/apache geode/1.12.5
- version/apache geode/1.13.0
- version/apache geode/1.13.4
- version/apache geode/1.14.0