groovy-1.8.9-8.el7
エラータID: AXSA:2017-2200:01
リリース日:
2017/09/14 Thursday - 10:59
題名:
groovy-1.8.9-8.el7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- クラスパス上で Apache Groovy を用いるアプリケーションが標準 Java シ
リアライズメカニズムを使用している場合，デシリアライズする際に，攻撃者が
直接コードを実行できる特殊なシリアライズオブジェクトを bake できる脆弱性
があります。(CVE-2016-6814)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2016-6814
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
追加情報:
N/A
ダウンロード:
SRPMS
- groovy-1.8.9-8.el7.src.rpm
MD5: 71911ee6823dc133d98c20be1cf3175c
SHA-256: 24daef86be5dd91fdf50e85ea69225b8d6c5ea644fcd3fb8ed4d358a923bbce8
Size: 12.16 MB
Asianux Server 7 for x86_64
- groovy-1.8.9-8.el7.noarch.rpm
MD5: 944d18e8c269707666fe519fde381b2b
SHA-256: 39d99fae6240f13e1ea4e0a08d0b5f5d52c6bc358ec26003ae98ffd56fe3e6bd
Size: 4.68 MB - groovy-javadoc-1.8.9-8.el7.noarch.rpm
MD5: 33e43959a9d9301d069eca0e6d33418d
SHA-256: 2787792da6577c7c0ac71447fd03d09c6f308821fc0bedeb831a588a5a4582b5
Size: 1.61 MB
English