Back to Vulnerability Directory
CRITICALFixed upstream
CVE-2018-1295
Apache Ignite: deserialization endpoints allow code execution
Technology
Apache Ignite
CVSS Score
9.8 / 10.0
Affected Versions
Apache Ignite 2.3 and earlier
Upstream Fix
2.4, with IGNITE_MARSHALLER_WHITELIST or IGNITE_MARSHALLER_BLACKLIST set
Published
April 2, 2018
OSSeva Coverage
Fixed upstream
Description
The serialization mechanism had no list of classes allowed for deserialization, so a specially prepared serialized object sent to the discovery SPI, Ignite persistence, the Memcached endpoint or the socket streamer can run arbitrary code when a vulnerable third-party class is on the classpath.
Is your Apache Ignite deployment affected?
If you're running Apache Ignite 2.3 and earlier, you need this patch. Book a discovery call to get covered.