CVE-2021-37578: Apache jUDDI Deserialization of Untrusted Data
Summary
CVE-2021-37578: Deserialization of Untrusted Data in Apache jUDDI. Affects org.apache.juddi:juddi-core versions < 3.3.10. Fixed in 3.3.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache jUDDI is a Java-based implementation of the Universal Description, Discovery, and Integration (UDDI) specification. It provides a registry for web services, allowing service providers to publish their services and clients to discover and consume them. jUDDI uses Java's Remote Method Invocation (RMI) to provide an alternate transport for accessing UDDI services. RMI uses Java serialization to pass parameters in RMI invocations. However, jUDDI does not properly validate the deserialized data, allowing a remote attacker to send a malicious serialized object and potentially execute arbitrary code on the target system.
Vulnerability Detail
The vulnerability (CVE-2021-37578) in Apache jUDDI arises from the lack of input validation during deserialization of untrusted data. By sending a specially crafted serialized object to the RMI entries, an attacker can exploit this vulnerability to execute arbitrary code remotely. This can lead to a complete compromise of the affected system, allowing the attacker to perform unauthorized actions, access sensitive information, or disrupt the availability of the service. The impact of this vulnerability is considered critical, with a CVSS score of 9.8.
How To Fix
Minimum fixed version
3.3.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, it is recommended to disable the usage of RMI in both jUDDI web service applications and jUDDI clients. By default, RMI is disabled in these components, but it is important to verify and ensure that RMI is not enabled in the configuration. Disabling RMI will mitigate the risk of deserialization attacks.
Conclusion
The vulnerability in Apache jUDDI allows for the remote execution of arbitrary code, posing a significant risk to the security and integrity of affected systems. It is crucial to promptly upgrade to the latest version of Apache jUDDI (3.3.10 or later) to eliminate the vulnerability. Alternatively, disabling RMI usage can serve as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.juddi:juddi-core →
FAQ
Apache jUDDI is a Java-based implementation of the UDDI specification, providing a registry for web services.
The vulnerability allows a remote attacker to execute arbitrary code on the target system, potentially leading to a complete compromise of the affected system.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to Apache jUDDI version 3.3.10 or later.
Yes, as a workaround, you can disable the usage of RMI in jUDDI web service applications and jUDDI clients.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
