CVE-2016-10750 Deserialization of Untrusted Data in Hazelcast
HighCVSS 8.1
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.hazelcast/hazelcast(Maven) | < 3.11 | 3.11 |
| com.hazelcast/hazelcast(Maven) | = 1.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.5.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.5.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.5.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.6-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.7-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.7-RC2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.7-RC3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.7-RC4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.7.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.8.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.8.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.8.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.8.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.8.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.1-RC2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.2.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.2.2 | No fix listed |
Show 153 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.hazelcast/hazelcast(Maven) | = 1.9.2.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.3-RC | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.3.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.3.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.3.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.3.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4-RC | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 1.9.4.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.0 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.0-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.0-RC2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.0.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.0.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.0.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.0.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.1.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.1.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.1.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.3.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.4.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.5.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.10 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 2.6.9 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.0 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.0-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.0-RC2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.0.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.0.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.0.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.1.9 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10-BETA-1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10-BETA-2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.10.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.11-BETA-1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2-RC2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.2.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3-EA | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3-EA2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3-RC2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3-RC3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.3.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4-EA | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.4.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.5-EA | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.5.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.5.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.5.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.5.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.5.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6-EA | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6-EA2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6-EA3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.6.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7-EA | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.7.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8-EA | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8-RC1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.4 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.5 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.6 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.7 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.8 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.8.9 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.9 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.9-EA | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.9.1 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.9.2 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.9.3 | No fix listed |
| com.hazelcast/hazelcast(Maven) | = 3.9.4 | No fix listed |
| hazelcast | < 3.11 | 3.11 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com
- RHSA-2019:2413 vendor-advisory