Read the docs
TI-2022-17225 Aliases CVE-2022-37021GHSA-q4q3-r45f-7gwg

Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.

Priority MEDIUM 47CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.

Why it matters now

EPSS 0.02638 85th percentileScored 2026-11-07
Fix Fixed org.apache.geode:geode-core (Maven): 1.12.16, 1.13.5, 1.14.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache GeodeApache Geode – 1.12.5—No fix listedCNA
—org.apache.geode:geode-core (Maven)before 1.12.161.12.16Patch availableGHSA-q4q3-r45f-7gwg
—org.apache.geode:geode-core (Maven)1.13.0 to before 1.13.51.13.5Patch availableGHSA-q4q3-r45f-7gwg
—org.apache.geode:geode-core (Maven)1.14.0 to before 1.14.11.14.1Patch availableGHSA-q4q3-r45f-7gwg
  • Apache Geode VendorApache Affected Apache Geode – 1.12.5 Fixed in — No fix listed CNA
  • org.apache.geode:geode-core (Maven) Vendor— Affected before 1.12.16 Fixed in 1.12.16 Patch available GHSA-q4q3-r45f-7gwg
  • org.apache.geode:geode-core (Maven) Vendor— Affected 1.13.0 to before 1.13.5 Fixed in 1.13.5 Patch available GHSA-q4q3-r45f-7gwg
  • org.apache.geode:geode-core (Maven) Vendor— Affected 1.14.0 to before 1.14.1 Fixed in 1.14.1 Patch available GHSA-q4q3-r45f-7gwg

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:*up to 1.12.5; 1.13.0 – 1.13.4VulnerableApache
cpe:2.3:a:apache:geode:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableApache
  • cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:* Versions up to 1.12.5; 1.13.0 – 1.13.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:geode:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-q4q3-r45f-7gwg org.apache.geode:geode-core (Maven) Fixed in 1.12.16 Advisory →
  • Fix · GHSA-q4q3-r45f-7gwg org.apache.geode:geode-core (Maven) Fixed in 1.13.5 Advisory →
  • Fix · GHSA-q4q3-r45f-7gwg org.apache.geode:geode-core (Maven) Fixed in 1.14.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-37021
  2. 2026-10-03 Alias added: GHSA-q4q3-r45f-7gwg

References

Advisory 2

  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
  • TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
  • TI-2017-11469 Incorrect authorization in Apache Geode CVSS 3.0HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences