In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2018-04-02T17:00:00Z

Updated: 2024-09-17T01:06:48.932Z

Reserved: 2017-12-07T00:00:00

Link: CVE-2018-1295

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-04-02T17:29:00.277

Modified: 2024-11-21T03:59:33.920

Link: CVE-2018-1295

cve-icon Redhat

Severity : Important

Publid Date: 2018-04-02T00:00:00Z

Links: CVE-2018-1295 - Bugzilla