CVE-2022-37023: Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-37023?
CVE-2022-37023 is a vulnerability in Apache Geode versions prior to 1.15.0 that allows for deserialization of untrusted data when using the REST API on Java 8 or Java 11.
How does CVE-2022-37023 impact Apache Geode?
CVE-2022-37023 impacts Apache Geode versions prior to 1.15.0 by allowing an attacker to exploit deserialization vulnerabilities when utilizing the REST API with Java 8 or Java 11.
What is the severity of CVE-2022-37023?
The severity of CVE-2022-37023 is medium, with a CVSS score of 6.5.
How can I fix CVE-2022-37023?
To fix CVE-2022-37023, users should upgrade to Apache Geode 1.15.0 and follow the documentation provided by Apache for further details on the upgrade process.
Are there any additional references related to CVE-2022-37023?
Yes, you can refer to the following link for more information: [Apache Geode Vulnerability](https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj)