VMware Spring up to 4.3.22/5.1.11/5.2.7/5.3.1 Kryo Codec deserialization

Summaryinfo

A vulnerability was found in VMware Spring up to 4.3.22/5.1.11/5.2.7/5.3.1. It has been classified as critical. This affects an unknown function of the component Kryo Codec. Performing a manipulation results in deserialization. This vulnerability is known as CVE-2020-5413. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in VMware Spring up to 4.3.22/5.1.11/5.2.7/5.3.1. This affects an unknown code block of the component Kryo Codec. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.

The weakness was published 07/31/2020 (Website). It is possible to read the advisory at tanzu.vmware.com. This vulnerability is uniquely identified as CVE-2020-5413 since 01/03/2020. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.3.23, 5.1.12, 5.2.8 or 5.3.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• VMware

Name

• Spring

Version

• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.3.4
• 4.3.5
• 4.3.6
• 4.3.7
• 4.3.8
• 4.3.9
• 4.3.10
• 4.3.11
• 4.3.12
• 4.3.13
• 4.3.14
• 4.3.15
• 4.3.16
• 4.3.17
• 4.3.18
• 4.3.19
• 4.3.20
• 4.3.21
• 4.3.22
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 5.1.10
• 5.1.11
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.3.0
• 5.3.1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion