CVE-2017-15692 Apache Geode unsafe deserialization in TcpServer

What is CVE-2017-15692?

CVE-2017-15692 is a critical unsafe deserialization vulnerability in Apache Geode, published on 27 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath.

Weakness: CWE-502

Which versions are affected by CVE-2017-15692?

2 open source packages ship an affected version, including org.apache.geode:geode-core. It affects 1 product.

Products include Apache Geode.

How do I fix CVE-2017-15692?

Upgrade org.apache.geode:geode-core to 1.4.0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-15692 being exploited?

There is no known exploitation of CVE-2017-15692 in the wild and no public exploit code.

Other vulnerabilities in Apache Geode

• CVE-2020-1938 Apache Tomcat Improper Privilege Management Exploited Critical 9.8
• CVE-2019-15752 Docker Desktop Community Edition Privilege Escalation Exploited High 7.8
• CVE-2022-37021 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. Critical 9.8
• CVE-2014-0048 Supply chain in docker.io Critical 9.8
• CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w395-hpq9-7xwr.