2017-10-16 12:31:07 -04:00
{
2019-03-18 01:17:20 +00:00
"CVE_data_meta" : {
"ASSIGNER" : "secalert@redhat.com" ,
"ID" : "CVE-2016-2170" ,
"STATE" : "PUBLIC"
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a" ,
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
} ,
"vendor_name" : "n/a"
}
]
}
} ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
2017-10-16 12:31:07 -04:00
{
2019-03-18 01:17:20 +00:00
"lang" : "eng" ,
"value" : "Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library."
2017-10-16 12:31:07 -04:00
}
2019-03-18 01:17:20 +00:00
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "n/a"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "http://ofbiz.apache.org/download.html#vulnerabilities" ,
"refsource" : "CONFIRM" ,
"url" : "http://ofbiz.apache.org/download.html#vulnerabilities"
} ,
{
"name" : "https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04" ,
"refsource" : "CONFIRM" ,
"url" : "https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04"
} ,
{
"name" : "1035513" ,
"refsource" : "SECTRACK" ,
"url" : "http://www.securitytracker.com/id/1035513"
} ,
{
"name" : "https://issues.apache.org/jira/browse/OFBIZ-6726" ,
"refsource" : "CONFIRM" ,
"url" : "https://issues.apache.org/jira/browse/OFBIZ-6726"
} ,
{
"name" : "https://cwiki.apache.org/confluence/display/OFBIZ/The+infamous+Java+serialization+vulnerability" ,
"refsource" : "CONFIRM" ,
"url" : "https://cwiki.apache.org/confluence/display/OFBIZ/The+infamous+Java+serialization+vulnerability"
} ,
{
"name" : "20160408 CVE-2016-2170: Apache OFBiz information disclosure vulnerability" ,
"refsource" : "BUGTRAQ" ,
"url" : "http://www.securityfocus.com/archive/1/538034/100/0/threaded"
} ,
{
"name" : "https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07" ,
"refsource" : "CONFIRM" ,
"url" : "https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07"
} ,
{
"name" : "http://packetstormsecurity.com/files/136639/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html" ,
"refsource" : "MISC" ,
"url" : "http://packetstormsecurity.com/files/136639/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html"
2021-03-25 19:00:43 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-dev] 20210325 Comment out the SOAP and HTTP engines?" ,
"url" : "https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0@%3Cdev.ofbiz.apache.org%3E"
2021-03-25 22:00:40 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-dev] 20210325 Re: Comment out the SOAP and HTTP engines?" ,
"url" : "https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6@%3Cdev.ofbiz.apache.org%3E"
2021-03-29 09:00:37 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-dev] 20210329 Re: Comment out the SOAP and HTTP engines?" ,
"url" : "https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a@%3Cdev.ofbiz.apache.org%3E"
2021-03-29 13:00:36 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210329 [jira] [Commented] (OFBIZ-12167) Adds a blacklist (to be renamed soon to denylist) in Java serialisation (CVE-2021-26295)" ,
"url" : "https://lists.apache.org/thread.html/rc9bd0d3d794dc370bc70585960841868cb29b92dcc80552b84ca2599@%3Cnotifications.ofbiz.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210329 [jira] [Commented] (OFBIZ-6942) Comment out RMI related code because of the Java deserialization issue [CVE-2016-2170]" ,
"url" : "https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244@%3Cnotifications.ofbiz.apache.org%3E"
2021-04-27 21:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210427 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128]" ,
"url" : "https://lists.apache.org/thread.html/rbe512e5ccd6b11169c6379daa1234bc805f3d53c5a38224e956295ce@%3Cnotifications.ofbiz.apache.org%3E"
2021-06-05 17:00:46 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210605 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128]" ,
"url" : "https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735@%3Cnotifications.ofbiz.apache.org%3E"
2021-07-30 14:11:02 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210729 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128]" ,
"url" : "https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661@%3Cnotifications.ofbiz.apache.org%3E"
2019-03-18 01:17:20 +00:00
}
]
}
}
