Deserialization of Untrusted Data in Apache OpenJPA
High severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Feb 26, 2024
Package
Affected versions
>= 1.0.0, < 1.2.3
>= 2.0.0, < 2.2.2
Patched versions
1.2.3
2.2.2
Description
Published by the National Vulnerability Database
Jul 11, 2013
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Jul 8, 2022
Last updated
Feb 26, 2024
Credits
-
MarkLee131 Analyst
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
References