Vulnerabilities > CVE-2016-10750 - Deserialization of Untrusted Data vulnerability in Hazelcast

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

high complexity

hazelcast

CWE-502

NVD

Published: 2019-05-22

Updated: 2019-08-08

Summary

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.

Vulnerable Configurations

Part	Description	Count
Application	Hazelcast Hazelcast Hazelcast 1.9.3 Hazelcast Hazelcast 1.9.3.2 Hazelcast Hazelcast 1.9.3.3 Hazelcast Hazelcast 1.9.4 Hazelcast Hazelcast 1.9.4.1 Hazelcast Hazelcast 1.9.4.2 Hazelcast Hazelcast 1.9.4.3 Hazelcast Hazelcast 1.9.4.4 Hazelcast Hazelcast 1.9.4.6 Hazelcast Hazelcast 1.9.4.8 Hazelcast Hazelcast 1.9.4.9 Hazelcast Hazelcast 2.0 Hazelcast Hazelcast 2.0.1 Hazelcast Hazelcast 2.0.2 Hazelcast Hazelcast 2.0.3 Hazelcast Hazelcast 2.0.4 Hazelcast Hazelcast 2.1 Hazelcast Hazelcast 2.1.1 Hazelcast Hazelcast 2.1.2 Hazelcast Hazelcast 2.1.3 Hazelcast Hazelcast 2.2 Hazelcast Hazelcast 2.3 Hazelcast Hazelcast 2.3.1 Hazelcast Hazelcast 2.4 Hazelcast Hazelcast 2.4.1 Hazelcast Hazelcast 2.5 Hazelcast Hazelcast 2.5.1 Hazelcast Hazelcast 2.6 Hazelcast Hazelcast 2.6.1 Hazelcast Hazelcast 2.6.2 Hazelcast Hazelcast 2.6.3 Hazelcast Hazelcast 2.6.4 Hazelcast Hazelcast 2.6.5 Hazelcast Hazelcast 2.6.6 Hazelcast Hazelcast 2.6.7 Hazelcast Hazelcast 2.6.8 Hazelcast Hazelcast 2.6.9 Hazelcast Hazelcast 2.6.10 Hazelcast Hazelcast 3.0 Hazelcast Hazelcast 3.0.1 Hazelcast Hazelcast 3.0.2 Hazelcast Hazelcast 3.0.3 Hazelcast Hazelcast 3.1 Hazelcast Hazelcast 3.1.1 Hazelcast Hazelcast 3.1.2 Hazelcast Hazelcast 3.1.3 Hazelcast Hazelcast 3.1.4 Hazelcast Hazelcast 3.1.5 Hazelcast Hazelcast 3.1.6 Hazelcast Hazelcast 3.1.7 Hazelcast Hazelcast 3.1.8 Hazelcast Hazelcast 3.1.9 Hazelcast Hazelcast 3.2 Hazelcast Hazelcast 3.2.1 Hazelcast Hazelcast 3.2.2 Hazelcast Hazelcast 3.2.3 Hazelcast Hazelcast 3.2.4 Hazelcast Hazelcast 3.2.5 Hazelcast Hazelcast 3.2.6 Hazelcast Hazelcast 3.2.7 Hazelcast Hazelcast 3.3 Hazelcast Hazelcast 3.3.1 Hazelcast Hazelcast 3.3.2 Hazelcast Hazelcast 3.3.3 Hazelcast Hazelcast 3.3.4 Hazelcast Hazelcast 3.3.5 Hazelcast Hazelcast 3.3.6 Hazelcast Hazelcast 3.4 Hazelcast Hazelcast 3.4.1 Hazelcast Hazelcast 3.4.2 Hazelcast Hazelcast 3.4.3 Hazelcast Hazelcast 3.4.4 Hazelcast Hazelcast 3.4.5 Hazelcast Hazelcast 3.4.6 Hazelcast Hazelcast 3.4.7 Hazelcast Hazelcast 3.4.8 Hazelcast Hazelcast 3.5 Hazelcast Hazelcast 3.5.1 Hazelcast Hazelcast 3.5.2 Hazelcast Hazelcast 3.5.3 Hazelcast Hazelcast 3.5.4 Hazelcast Hazelcast 3.5.5 Hazelcast Hazelcast 3.6 Hazelcast Hazelcast 3.6.1 Hazelcast Hazelcast 3.6.2 Hazelcast Hazelcast 3.6.3 Hazelcast Hazelcast 3.6.4 Hazelcast Hazelcast 3.6.5 Hazelcast Hazelcast 3.6.6 Hazelcast Hazelcast 3.6.7 Hazelcast Hazelcast 3.6.8 Hazelcast Hazelcast 3.7 Hazelcast Hazelcast 3.7.1 Hazelcast Hazelcast 3.7.2 Hazelcast Hazelcast 3.7.3 Hazelcast Hazelcast 3.7.4 Hazelcast Hazelcast 3.7.5 Hazelcast Hazelcast 3.7.6 Hazelcast Hazelcast 3.7.7 Hazelcast Hazelcast 3.7.8 Hazelcast Hazelcast 3.8 Hazelcast Hazelcast 3.8.1 Hazelcast Hazelcast 3.8.2 Hazelcast Hazelcast 3.8.3 Hazelcast Hazelcast 3.8.4 Hazelcast Hazelcast 3.8.5 Hazelcast Hazelcast 3.8.6 Hazelcast Hazelcast 3.8.7 Hazelcast Hazelcast 3.8.8 Hazelcast Hazelcast 3.8.9 Hazelcast Hazelcast 3.9 Hazelcast Hazelcast 3.9.1 Hazelcast Hazelcast 3.9.2 Hazelcast Hazelcast 3.9.3 Hazelcast Hazelcast 3.9.4 Hazelcast Hazelcast 3.10 Hazelcast Hazelcast 3.10.1 Hazelcast Hazelcast 3.10.2 Hazelcast Hazelcast 3.10.3 Hazelcast Hazelcast 3.10.4 Hazelcast Hazelcast 3.10.5 Hazelcast Hazelcast 3.10.6 Hazelcast Hazelcast 3.10.7	229

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Redhat

advisories

rhsa

id	RHSA-2019:2413

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Redhat

References