{"id":"GHSA-fjq5-5j5f-mvxh","summary":"Deserialization of Untrusted Data in Apache commons collections","details":"It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.","aliases":["CVE-2015-7501"],"modified":"2024-02-17T05:37:14.855709Z","published":"2022-05-13T01:25:20Z","database_specific":{"nvd_published_at":"2017-11-09T17:29:00Z","cwe_ids":["CWE-502"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2022-11-03T22:57:31Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7501"},{"type":"WEB","url":"https://access.redhat.com/security/vulnerabilities/2059393"},{"type":"WEB","url":"https://access.redhat.com/solutions/2045023"},{"type":"WEB","url":"https://arxiv.org/pdf/2306.05534.pdf"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1279330"},{"type":"WEB","url":"https://commons.apache.org/proper/commons-collections/release_4_1.html"},{"type":"WEB","url":"https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability"},{"type":"PACKAGE","url":"https://github.com/apache/commons-collections"},{"type":"WEB","url":"https://github.com/jensdietrich/xshady-release/tree/main/CVE-2015-7501"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/COLLECTIONS-580."},{"type":"WEB","url":"https://sourceforge.net/p/collections/code/HEAD/tree"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2016-1773.html"}],"affected":[{"package":{"name":"commons-collections:commons-collections","ecosystem":"Maven","purl":"pkg:maven/commons-collections/commons-collections"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["1.0","2.0","2.0.20020914.015953","2.0.20020914.020746","2.0.20020914.020858","2.1","2.1.1","3.0","3.0-dev2","3.1","3.2","3.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fjq5-5j5f-mvxh/GHSA-fjq5-5j5f-mvxh.json"}},{"package":{"name":"org.apache.commons:commons-collections4","ecosystem":"Maven","purl":"pkg:maven/org.apache.commons/commons-collections4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1"}]}],"versions":["4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fjq5-5j5f-mvxh/GHSA-fjq5-5j5f-mvxh.json"}},{"package":{"name":"org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections","ecosystem":"Maven","purl":"pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.1"}]}],"versions":["3.2.1_1","3.2.1_2","3.2.1_3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fjq5-5j5f-mvxh/GHSA-fjq5-5j5f-mvxh.json","last_known_affected_version_range":"\u003c 3.2.2"}},{"package":{"name":"net.sourceforge.collections:collections-generic","ecosystem":"Maven","purl":"pkg:maven/net.sourceforge.collections/collections-generic"},"versions":["4.01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fjq5-5j5f-mvxh/GHSA-fjq5-5j5f-mvxh.json"}},{"package":{"name":"org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic","ecosystem":"Maven","purl":"pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.collections-generic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.01"}]}],"versions":["4.01_1"],"database_specific":{"last_known_affected_version_range":"\u003c 4.02","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fjq5-5j5f-mvxh/GHSA-fjq5-5j5f-mvxh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}