CoreCVE
Back

CRITICAL

Groovy: Remote code execution via deserialization

Published Jan 18, 2018

Description

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.

Affected products

Remediation

Red Hat statement

This issue affects the versions of groovy as shipped with Red Hat Satellite 6.0 and 6.1. Red Hat Satellite 6.2 and later do not ship groovy, as such they are not affected by this vulnerability.

Metrics

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (21)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 18, 2018
Updated Sep 16, 2024
Reserved Aug 12, 2016
Link CVE-2016-6814
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2016-6814
Red Hat
Severity Important
Public date Jan 14, 2017
Links CVE-2016-6814 - Bugzilla
GHSA-XPHJ-M9CC-8FMQ