Maven/org.apache.flex.blazeds:flex-messaging-remoting CVE-2017-5641: critical 9.8, EPSS 20.75%
Apache Flex BlazeDS unsafe deserialization
Action: Upgrade org.apache.flex.blazeds:flex-messaging-remoting to 4.7.3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.7.3 | - |
Fixed versions
| 4.7.3 |
Sources
- osv: GHSA-w8v7-prhw-xjpw#Maven/org.apache.flex.blazeds:flex-messaging-remoting
- https://nvd.nist.gov/vuln/detail/CVE-2017-5641
- https://github.com/apache/flex-blazeds/commit/11b0aa132d9a43bf81fa12654ff227ff247b4627
- https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1
- https://github.com/apache/flex-blazeds
- https://issues.apache.org/jira/browse/FLEX-35290
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03823en_us
- https://web.archive.org/web/20170920093830/http://www.securitytracker.com/id/1038273
- https://web.archive.org/web/20210124021605/http://www.securityfocus.com/bid/97383
- https://www.kb.cert.org/vuls/id/307983
- https://www.zerodayinitiative.com/advisories/ZDI-22-506
- https://www.zerodayinitiative.com/advisories/ZDI-22-507
- http://mail-archives.apache.org/mod_mbox/flex-dev/201703.mbox/%3C6B86C8D0-6E36-48F5-AC81-4AB3978F6746@c-ware.de%3E
CVE-2017-5641 · published · modified · JSON