Information disclosure in Apache Geode
Priority LOW 32CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.
Why it matters now
EPSS 0.01358 71st percentileScored 2026-11-07
Fix Fixed org.apache.geode:geode-core (Maven): 1.2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Geode | 1.0.0; 1.1.0; 1.1.1; 1.2.0 | — | No fix listed | CNA |
| — | org.apache.geode:geode-core (Maven) | 1.0.0 to before 1.2.1 | 1.2.1 | Patch available | GHSA-vh98-fqfc-4hj3 |
- Apache Geode VendorApache Affected 1.0.0; 1.1.0; 1.1.1; 1.2.0 Fixed in — No fix listed CNA
- org.apache.geode:geode-core (Maven) Vendor— Affected 1.0.0 to before 1.2.1 Fixed in 1.2.1 Patch available GHSA-vh98-fqfc-4hj3
Remediation
- Fix · GHSA-vh98-fqfc-4hj3 org.apache.geode:geode-core (Maven) Fixed in 1.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9797
- 2026-10-03 Alias added: GHSA-vh98-fqfc-4hj3
References
Other 4
- [geode-user] 20170929 [SECURITY] CVE-2017-9797 Apache Geode client/server authentication vulnerability
- https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-SecurityVulnerabilities
- https://issues.apache.org/jira/browse/GEODE-3249
- http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-Hrbb7JS8Nygrh7geyFvW4bMZ3AdCmPOzMfvbniipz0bA@mail.gmail.com%3e
More Apache Geode vulnerabilities
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
- TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
- TI-2022-17225 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-9797 · CVE Program
- CVE-2017-9797 · NVD
- FIRST EPSS
- GHSA-vh98-fqfc-4hj3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences