CVE-2016-6814 Deserialization of Untrusted Data in Groovy
Attackers can execute arbitrary code by sending specially crafted serialized objects to applications using vulnerable Groovy versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6814?
CVE-2016-6814 is a critical unsafe deserialization vulnerability in Redhat Enterprise Linux Server, published on 18 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
Weakness: CWE-502
Which versions are affected by CVE-2016-6814?
4 open source packages ship an affected version, including org.codehaus.groovy:groovy and org.codehaus.groovy:groovy-all. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.codehaus.groovy:groovy Maven | From 1.7.0 | 2.4.8 |
org.codehaus.groovy:groovy Maven | From 1.7.0 | 2.4.8 |
org.codehaus.groovy:groovy-all Maven | From 1.7.0 | 2.4.8 |
org.codehaus.groovy:groovy-all Maven | From 1.7.0 | 2.4.8 |
Products include Apache Groovy, Redhat Enterprise Linux Server.
How do I fix CVE-2016-6814?
Upgrade org.codehaus.groovy:groovy to 2.4.8 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2016-6814 being exploited?
There is no known exploitation of CVE-2016-6814 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux Server
Sources
Also known as DEBIAN-CVE-2016-6814, DLA-794-1, GHSA-xphj-m9cc-8fmq, MGASA-2017-0311, UBUNTU-CVE-2016-6814, USN-4795-1.