=====================================================================

                                   CERT-Renater

                       Note d'Information No. 2022/VULN302

_____________________________________________________________________

DATE                : 31/08/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Geode versions prior to
                                        1.15.0.

=====================================================================
https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr
https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4m
https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj
_____________________________________________________________________


CVE-2022-37021: Apache Geode deserialization of untrusted data flaw when
using JMX over RMI on Java 8.


Severity: high - possible RCE

Description:

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to
a deserialization of untrusted data flaw when using JMX over RMI on Java
8.
Any user still on Java 8 who wishes to protect against deserialization
attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and
Java 11.
If upgrading to Java 11 is not possible, then upgrade to Apache Geode
1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when
starting any Locators or Servers. Follow the documentation for details
on specifying any user classes that may be serialized/deserialized with
the "serializable-object-filter" configuration option. Using a global
serial filter will impact performance.

This issue is being tracked as GEODE-9758

Mitigation:

Disable affected services such as JMX over RMI unless they are required. 
JMX over RMI can be disabled by setting Geode property `jmx-manager` to 
false; this property defaults to false on Servers and true on Locators.

_____________________________________________________________________


CVE-2022-37022: Apache Geode deserialization of untrusted data flaw when
using JMX over RMI on Java 11

Severity: high - possible RCE

Description:

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a
deserialization of untrusted data flaw when using JMX over RMI on Java
11.

Any user wishing to protect against deserialization attacks involving
JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11
will automatically protect JMX over RMI against deserialization attacks.
This should have no impact on performance since it only affects JMX/RMI
which Gfsh uses to communicate with the JMX Manager which is hosted on a
Locator.

This issue is being tracked as GEODE-9064


Mitigation:

Disable affected services such as JMX over RMI unless they are required.
JMX over RMI can be disabled by setting Geode property `jmx-manager` to
false; this property defaults to false on Servers and true on Locators.

_____________________________________________________________________

CVE-2022-37023: Apache Geode deserialization of untrusted data flaw when 
using REST API on Java 8 or Java 11

Severity: high - possible RCE

Description:

Apache Geode versions prior to 1.15.0 are vulnerable to a
deserialization of untrusted data flaw when using REST API on Java 8 or
Java 11.

Any user wishing to protect against deserialization attacks involving
REST APIs should upgrade to Apache Geode 1.15 and follow the
documentation for details on enabling "validate-serializable-
objects=true" and specifying any user classes that may be
serialized/deserialized with "serializable-object-filter". Enabling
"validate-serializable-objects" may impact performance.


Mitigation:

Disable affected services such as JMX over RMI or REST APIs unless they
are required. REST APIs can be disabled by setting `http-service-port`
to zero.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================