ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
References
Link | Resource |
---|---|
https://discuss.gradle.org/t/a-security-issue-about-gradle-rce/17726 | Exploit Technical Description Third Party Advisory |
https://philwantsfish.github.io/security/java-deserialization-github | Release Notes Vendor Advisory |
https://discuss.gradle.org/t/a-security-issue-about-gradle-rce/17726 | Exploit Technical Description Third Party Advisory |
https://philwantsfish.github.io/security/java-deserialization-github | Release Notes Vendor Advisory |
Configurations
History
21 Nov 2024, 02:55
Type | Values Removed | Values Added |
---|---|---|
References | () https://discuss.gradle.org/t/a-security-issue-about-gradle-rce/17726 - Exploit, Technical Description, Third Party Advisory | |
References | () https://philwantsfish.github.io/security/java-deserialization-github - Release Notes, Vendor Advisory |
Information
Published : 2017-02-07 15:59
Updated : 2024-11-21 02:55
NVD link : CVE-2016-6199
Mitre link : CVE-2016-6199
CVE.ORG link : CVE-2016-6199
JSON object : View
Products Affected
gradle
- gradle
CWE
CWE-502
Deserialization of Untrusted Data