[
https://issues.apache.org/jira/browse/TINKERPOP-2882?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jim Foscue updated TINKERPOP-2882:
----------------------------------
Component/s: (was: neo4j)
> Vulnerability in com.hazelcase_hazelcast-3.7.8
> ----------------------------------------------
>
> Key: TINKERPOP-2882
> URL: https://issues.apache.org/jira/browse/TINKERPOP-2882
> Project: TinkerPop
> Issue Type: Improvement
> Affects Versions: 3.6.2
> Reporter: Jim Foscue
> Priority: Major
> Labels: Ironbank
>
> Vulnerability in com.hazelcase_hazelcast-3.7.8
> Need to update to hazelcast libraries.
> [https://nvd.nist.gov/vuln/detail/CVE-2022-36437]
> Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service
> that arbitrarily deserializes Java objects, e.g., through setSessionVariable.
> An attacker can abuse this for remote code execution because there are
> dependencies with exploitable gadget chains.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
