Skip to content
Sign in
Not rated

CVE-2019-17556 Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and…

Description

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.

Affected products and versions

Product Affected versions Fixed in
Olingo Versions not published

Other CVEs of Olingo

The 3 CVEs of Olingo →
CVE-2019-17555 The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it… Not rated CVE-2019-17554 The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the… Not rated
Track this CVE