CVE-2019-17556: Apache Olingo Deserialization of Untrusted Data
Summary
CVE-2019-17556: Deserialization of Untrusted Data in Apache Olingo. Affects org.apache.olingo:odata-client-proxy versions >= 4.0.0, < 4.7.0. Fixed in 4.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Olingo is an open-source Java library that provides a framework for developing OData (Open Data Protocol) services. It offers a set of APIs and tools to simplify the creation and consumption of OData services. The library includes the AbstractService class, which is a public API used for handling OData requests and responses. This class utilizes ObjectInputStream for deserialization without proper validation of the deserialized classes.
Vulnerability Detail
The vulnerability (CVE-2019-17556) in Apache Olingo versions 4.0.0 to 4.6.0 arises from the lack of class validation during deserialization. An attacker can exploit this by providing malicious metadata to the AbstractService class, potentially leading to the execution of arbitrary code. This vulnerability poses a significant risk as it allows an attacker to compromise the integrity, confidentiality, and availability of the affected system.
How To Fix
Minimum fixed version
4.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, developers can implement their own class validation logic before deserialization. This can involve checking the class type and ensuring it belongs to an expected set of classes. Here is an example of how this can be done in Java:
private Object deserialize(byte[] data) throws IOException, ClassNotFoundException {
ByteArrayInputStream bis = new ByteArrayInputStream(data);
ObjectInputStream ois = new ObjectInputStream(bis);
Class<?> expectedClass = MyExpectedClass.class; // Replace with the expected class
Object deserializedObject = ois.readObject();
if (!expectedClass.isInstance(deserializedObject)) {
throw new ClassNotFoundException("Invalid class type during deserialization");
}
return deserializedObject;
}
Conclusion
The vulnerability (CVE-2019-17556) in Apache Olingo versions 4.0.0 to 4.6.0 allows for the deserialization of untrusted data, potentially leading to the execution of arbitrary code. It is crucial to upgrade to Apache Olingo version 4.7.0 or later to mitigate this vulnerability. If immediate upgrade is not possible, implementing custom class validation logic can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.olingo:odata-client-proxy →
FAQ
Apache Olingo is an open-source Java library for developing and consuming OData services.
OData (Open Data Protocol) is a protocol for building and consuming RESTful APIs over structured data.
The vulnerability affects Apache Olingo versions 4.0.0 to 4.6.0.
This vulnerability allows an attacker to execute arbitrary code, potentially compromising the affected system's integrity, confidentiality, and availability.
To fix this vulnerability, it is recommended to upgrade to Apache Olingo version 4.7.0 or later.
