2021-01-28 14:00:39 +00:00
{
"CVE_data_meta" : {
2021-03-22 11:54:57 +00:00
"AKA" : "Java serialisation" ,
"ASSIGNER" : "security@apache.org" ,
2021-01-28 14:00:39 +00:00
"ID" : "CVE-2021-26295" ,
2021-03-22 11:54:57 +00:00
"STATE" : "PUBLIC" ,
"TITLE" : "RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI"
2021-01-28 14:00:39 +00:00
} ,
2021-03-22 11:54:57 +00:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "Apache OFBiz" ,
"version" : {
"version_data" : [
{
"version_name" : "Apache OFBiz" ,
"version_value" : "17.12.01 to 17.12.05"
}
]
}
}
]
} ,
"vendor_name" : "Apache Software Foundation"
}
]
}
} ,
"credit" : [
{
"lang" : "eng" ,
"value" : "Apache OFBiz would like to thank the first report from \"r00t4dm at Cloud-Penetrating Arrow Lab and Longofo at Knownsec 404 Team\" and the second report by MagicZero from SGLAB of Legendsec at Qi'anxin Group."
}
] ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2021-01-28 14:00:39 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-03-22 13:00:41 +00:00
"value" : "Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz."
2021-03-22 11:54:57 +00:00
}
]
} ,
"generator" : {
"engine" : "Vulnogram 0.0.9"
} ,
"impact" : { } ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "Java serialisation"
}
]
2021-01-28 14:00:39 +00:00
}
]
2021-03-22 11:54:57 +00:00
} ,
"references" : {
"reference_data" : [
{
2021-03-22 13:00:41 +00:00
"refsource" : "MISC" ,
"url" : "https://lists.apache.org/thread.html/r3c1802eaf34aa78a61b4e8e044c214bc94accbd28a11f3a276586a31%40%3Cuser.ofbiz.apache.org%3E" ,
"name" : "https://lists.apache.org/thread.html/r3c1802eaf34aa78a61b4e8e044c214bc94accbd28a11f3a276586a31%40%3Cuser.ofbiz.apache.org%3E"
2021-03-24 13:00:41 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210324 [jira] [Commented] (OFBIZ-12167) Adds a blacklist (to be renamed soon to denylist) in Java serialisation (CVE-2021-26295)" ,
"url" : "https://lists.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607@%3Cnotifications.ofbiz.apache.org%3E"
2021-03-25 19:00:43 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-dev] 20210325 Comment out the SOAP and HTTP engines?" ,
"url" : "https://lists.apache.org/thread.html/r0d97a3b7a14777b9e9e085b483629d2774343c4723236d1c73f43ff0@%3Cdev.ofbiz.apache.org%3E"
2021-03-25 22:00:40 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-dev] 20210325 Re: Comment out the SOAP and HTTP engines?" ,
"url" : "https://lists.apache.org/thread.html/reccf8c8a58337ce7c035495d3d82fbc549e97036a9789a2a7d9cccf6@%3Cdev.ofbiz.apache.org%3E"
2021-03-29 09:00:37 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-dev] 20210329 Re: Comment out the SOAP and HTTP engines?" ,
"url" : "https://lists.apache.org/thread.html/rec5e9fdcdca13099cfb29f632333f44ad1dd60d90f67b90434e4467a@%3Cdev.ofbiz.apache.org%3E"
2021-03-29 13:00:36 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210329 [jira] [Commented] (OFBIZ-12167) Adds a blacklist (to be renamed soon to denylist) in Java serialisation (CVE-2021-26295)" ,
"url" : "https://lists.apache.org/thread.html/rc9bd0d3d794dc370bc70585960841868cb29b92dcc80552b84ca2599@%3Cnotifications.ofbiz.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210329 [jira] [Commented] (OFBIZ-6942) Comment out RMI related code because of the Java deserialization issue [CVE-2016-2170]" ,
"url" : "https://lists.apache.org/thread.html/r3ee005dd767cd83f522719423f5e7dd316f168ddbd1dc51a13d4e244@%3Cnotifications.ofbiz.apache.org%3E"
2021-04-06 16:00:39 +00:00
} ,
{
"refsource" : "MISC" ,
"name" : "http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html" ,
"url" : "http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html"
2021-04-27 21:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210427 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128]" ,
"url" : "https://lists.apache.org/thread.html/rbe512e5ccd6b11169c6379daa1234bc805f3d53c5a38224e956295ce@%3Cnotifications.ofbiz.apache.org%3E"
2021-04-27 22:00:47 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-commits] 20210427 [ofbiz-site] branch master updated: Updates security page for CVE-2021-29200 and 30128 fixed in 17.12.07" ,
"url" : "https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d@%3Ccommits.ofbiz.apache.org%3E"
2021-06-05 17:00:46 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210605 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128]" ,
"url" : "https://lists.apache.org/thread.html/rab718cfe6468085d7560c0c1ae816841e175886199f42e36efb8d735@%3Cnotifications.ofbiz.apache.org%3E"
2021-07-30 14:11:02 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-notifications] 20210729 [jira] [Updated] (OFBIZ-12212) Comment out the SOAP and HTTP engines - Fix [CVE-2021-30128]" ,
"url" : "https://lists.apache.org/thread.html/r078351a876ed284ba667b33aba29428d7308a5bd4df78f14a3df6661@%3Cnotifications.ofbiz.apache.org%3E"
2021-08-11 20:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[ofbiz-commits] 20210811 [ofbiz-site] branch master updated: Updates security page for CVE-2021-37608 fixed in 17.12.08" ,
"url" : "https://lists.apache.org/thread.html/rbe8439b26a71fc3b429aa793c65dcc4a6e349bc7bb5010746a74fa1d@%3Ccommits.ofbiz.apache.org%3E"
2021-03-22 11:54:57 +00:00
}
]
} ,
"source" : {
"advisory" : "OFBIZ-12167" ,
"defect" : [
"OFBIZ-12167"
] ,
"discovery" : "UNKNOWN"
} ,
"work_around" : [
{
"lang" : "eng" ,
"value" : "Upgrade to at least 17.12.06 or apply the patch at https://github.com/apache/ofbiz-framework/commit/af9ed4e/\n"
}
]
2021-03-22 13:00:41 +00:00
}
