{"action":"Upgrade org.apache.geode:geode-core to 1.12.16 (1.12.x), 1.13.5 (1.13.x) or 1.14.1 (1.14.x) or later.","affected":[{"fixed":"1.12.16","introduced":"0"},{"fixed":"1.13.5","introduced":"1.13.0"},{"fixed":"1.14.1","introduced":"1.14.0"}],"component":"org.apache.geode:geode-core","cve_ids":["CVE-2022-37021"],"ecosystem":"Maven","epss":0.02638,"exploited":false,"fixed_versions":["1.12.16","1.13.5","1.14.1"],"ghsa_id":"GHSA-q4q3-r45f-7gwg","id":"tcs_01M5N98MX2P1JRRPAWSGEV6ZV5","modified_at":"2023-11-08T04:10:06.364535Z","published_at":"2022-09-01T00:00:26Z","references":["https://osv.dev/vulnerability/GHSA-q4q3-r45f-7gwg","https://nvd.nist.gov/vuln/detail/CVE-2022-37021","https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-q4q3-r45f-7gwg","url":"https://osv.dev/vulnerability/GHSA-q4q3-r45f-7gwg"}],"summary":"Apache Geode vulnerable to Deserialization of Untrusted Data"}