Apache Software Foundation Geode 1.14.0

CPE Details

Apache Software Foundation Geode 1.14.0
apache
geode
1.14.0
2022-01-16
03h16 +00:00
2022-01-20
16h20 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:apache:geode:1.14.0:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

geode

Version

1.14.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-34870 2022-10-24 22h00 +00:00 Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
5.4
Medium
CVE-2022-37023 2022-08-31 05h00 +00:00 Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.
6.5
Medium
CVE-2022-37021 2022-08-31 05h00 +00:00 Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
9.8
Critical