Deserialization of untrusted data in Apache Geode
Priority LOW 38CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.
Why it matters now
EPSS 0.02469 84th percentileScored 2026-11-07
Fix Fixed org.apache.geode:geode-core (Maven): 1.4.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Geode | 1.0.0 to 1.3.0 | — | No fix listed | CNA |
| — | org.apache.geode:geode-core (Maven) | 1.0.0 to before 1.4.0 | 1.4.0 | Patch available | GHSA-95m2-p98f-24r5 |
- Apache Geode VendorApache Affected 1.0.0 to 1.3.0 Fixed in — No fix listed CNA
- org.apache.geode:geode-core (Maven) Vendor— Affected 1.0.0 to before 1.4.0 Fixed in 1.4.0 Patch available GHSA-95m2-p98f-24r5
Remediation
- Fix · GHSA-95m2-p98f-24r5 org.apache.geode:geode-core (Maven) Fixed in 1.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15693
- 2026-10-03 Alias added: GHSA-95m2-p98f-24r5
References
Other 4
- [user] 20180223 [SECURITY] CVE-2017-15693 Apache Geode unsafe deserialization of application objects
- https://github.com/apache/geode/pull/1166
- https://issues.apache.org/jira/browse/GEODE-3923
- https://lists.apache.org/thread.html/cc3ec1d06062f54fdaa0357874c1d148fc54bb955f2d2df4ca328a3d@%3Cuser.geode.apache.org%3E
More Apache Geode vulnerabilities
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
- TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
- TI-2022-17225 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-15693 · CVE Program
- CVE-2017-15693 · NVD
- FIRST EPSS
- GHSA-95m2-p98f-24r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences