CVE-2015-6420 Insecure Deserialization in Apache Commons Collection
CriticalCVSS 9.8
EPSS 24.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.commons/commons-collections4(Maven) | < 4.1 | 4.1 |
| commons-collections/commons-collections(Maven) | < 3.2.2 | 3.2.2 |
| net.sourceforge.collections/collections-generic(Maven) | <= 4.0.1 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.collections-generic(Maven) | <= 4.01 | No fix listed |
| org.apache.servicemix.bundles/org.apache.servicemix.bundles.commons-collections(Maven) | <= 3.2.1 | No fix listed |
| org.apache.commons/commons-collections4(Maven) | = 4.0 | No fix listed |
| commons-collections/commons-collections(Maven) | = 1.0 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0.20020914.015953 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0.20020914.020746 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.0.20020914.020858 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.1 | No fix listed |
| commons-collections/commons-collections(Maven) | = 2.1.1 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.0 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.0-dev2 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.1 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.2 | No fix listed |
| commons-collections/commons-collections(Maven) | = 3.2.1 | No fix listed |
| apache commons collections | >= 3.0, < 3.2.2 | 3.2.2 |
| apache commons collections | = 4.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- VU#581311 third-party-advisory
- www.tenable.com third-party-advisory
- www.tenable.com third-party-advisory
- 20151209 Vulnerability in Java Deserialization Affecting Cisco Products third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- 78872 third-party-advisory vdb-entry
- lists.apache.org
- arxiv.org
- github.com
- github.com product
- [samza-commits] 20210310 [GitHub] [samza] Telesia opened a new pull request #1471: SAMZA-2630: Upgrade dependencies for security fixes mailing-list vendor-advisory
- www.kb.cert.org third-party-advisory
- foxglovesecurity.com exploit third-party-advisory
- news.apache.org vendor-advisory