CVE-2015-3253
A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.
Find out more about CVE-2015-3253 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 6.8 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
CVSS v3 metrics
| CVSS3 Base Score | 9.6 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Changed |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | High |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat JBoss Fuse 6.2 | RHSA-2015:2556 | 2015-12-07 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (rh-maven33-groovy) | RHSA-2017:2596 | 2017-09-05 |
| Red Hat JBoss Operations Network 3.3 | RHSA-2016:0118 | 2016-02-03 |
| Red Hat JBoss A-MQ 6.2 | RHSA-2015:2557 | 2015-12-07 |
| Red Hat JBoss Data Virtualization 6.2 | RHSA-2016:0066 | 2016-01-25 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (rh-maven33-groovy) | RHSA-2017:2596 | 2017-09-05 |
| Red Hat JBoss Fuse Service Works 6.2 | RHSA-2015:2558 | 2015-12-07 |
| Red Hat JBoss SOA Platform 5.3 | RHSA-2016:1376 | 2016-06-30 |
| Red Hat Enterprise Linux 7 (groovy) | RHSA-2017:2486 | 2017-08-17 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat OpenShift Enterprise 2 | jenkins | Will not fix |
| Red Hat JBoss Portal Platform 6 | groovy-all | Affected |
| Red Hat JBoss Enterprise SOA Platform 4 | groovy-all | Will not fix |
| Red Hat JBoss EAP 5 | groovy-all | Will not fix |
| Red Hat JBoss BRMS 5 | groovy-all | Will not fix |
| Red Hat JBoss BPMS 6 | groovy-all | Not affected |
| RHEV Manager 3 | jasperreports-server-pro | Affected |
Mitigation
Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):
public class MethodClosure extends Closure {
+ private Object readResolve() {
+ throw new UnsupportedOperationException();
+
}
Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.