FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

groovy -- remote execution of untrusted code

Affected packages
1.7.0 <= groovy < 2.4.4

Details

VuXML ID 67b3fef2-2bea-11e5-86ff-14dae9d210b8
Discovery 2015-07-09
Entry 2015-07-16

Cédric Champeau reports:

Description

When an application has Groovy on the classpath and that it uses standard Java serialization mechanim to communicate between servers, or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.

References

CVE Name CVE-2015-3253
Message http://seclists.org/oss-sec/2015/q3/121
URL http://groovy-lang.org/security.html
URL https://issues.apache.org/jira/browse/GROOVY-7504