org.apache.geode:geode-core (Maven)
Advisories
20
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.15.1 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.geode</groupId><artifactId>geode-core</artifactId><version>1.15.1</version></dependency>gradle
implementation("org.apache.geode:geode-core:1.15.1")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-373r-9mg8-3jc4 Apache Geode vulnerable to Cross-Site Scripting |
Medium EPSS 1.38% |
< 1.15.1 | 1.15.1 |
| GHSA-q4q3-r45f-7gwg Apache Geode vulnerable to Deserialization of Untrusted Data |
Critical EPSS 2.64% |
< 1.12.16 | 1.12.16 |
| GHSA-qf8g-vpwp-6579 Apache Geode versions deserialization of untrusted datawhen using JMX over RMI on Java 11 |
High EPSS 1.51% |
< 1.15.0 | 1.15.0 |
| GHSA-q4q3-r45f-7gwg Apache Geode vulnerable to Deserialization of Untrusted Data |
Critical EPSS 2.64% |
>= 1.14.0, < 1.14.1 | 1.14.1 |
| GHSA-q4q3-r45f-7gwg Apache Geode vulnerable to Deserialization of Untrusted Data |
Critical EPSS 2.64% |
>= 1.13.0, < 1.13.5 | 1.13.5 |
| GHSA-72x9-48mc-phh6 Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data |
Medium EPSS 1.78% |
< 1.15.0 | 1.15.0 |
| GHSA-2gw6-73wc-x88f Apache Geode information disclosure vulnerability |
High EPSS 2.78% |
>= 1.1.0, < 1.1.1 | 1.1.1 |
| GHSA-37m3-qp37-x3c6 Apache Geode gfsh query vulnerability |
Medium EPSS 1.18% |
>= 1.0.0, < 1.2.1 | 1.2.1 |
| GHSA-h22r-h77w-2g5f Apache Geode gfsh authorization vulnerability |
High EPSS 2.08% |
>= 1.0.0, < 1.3.0 | 1.3.0 |
| GHSA-q7cp-r6cj-hpf5 Apache Geode OQL bind parameter vulnerability |
Medium EPSS 1.48% |
>= 1.0.0, < 1.3.0 | 1.3.0 |
| GHSA-g569-49wg-jx5f Apache Geode configuration request authorization vulnerability |
High EPSS 2.00% |
>= 1.0.0, < 1.4.0 | 1.4.0 |
| GHSA-95m2-p98f-24r5 Apache Geode unsafe deserialization of application objects |
High EPSS 2.47% |
>= 1.0.0, < 1.4.0 | 1.4.0 |
| GHSA-w395-hpq9-7xwr Apache Geode unsafe deserialization in TcpServer |
Critical EPSS 4.78% |
>= 1.0.0, < 1.4.0 | 1.4.0 |
| GHSA-6m68-3w55-6mx4 Apache Geode OQL method invocation vulnerability |
High EPSS 4.18% |
>= 1.0.0, < 1.3.0 | 1.3.0 |
| GHSA-vh98-fqfc-4hj3 Apache Geode vulnerable to Exposure of Sensitive Information |
Medium EPSS 1.36% |
>= 1.0.0, < 1.2.1 | 1.2.1 |
| GHSA-jmg4-x4vp-6c6x Apache Geode vulnerable to Incorrect Authorization |
High EPSS 2.51% |
>= 1.0.0, < 1.5.0 | 1.5.0 |
| GHSA-wc4x-4gm2-74j8 Apache Geode SSL endpoint verification vulnerability |
High EPSS 1.42% |
< 1.10.0 | 1.10.0 |
| GHSA-mw25-f5r2-hpc6 Insertion of Sensitive Information into Log File in Apache Geode |
High EPSS 2.60% |
>= 1.13.0, < 1.13.5 | 1.13.5 |
| GHSA-mw25-f5r2-hpc6 Insertion of Sensitive Information into Log File in Apache Geode |
High EPSS 2.60% |
< 1.12.5 | 1.12.5 |
| GHSA-p426-qw2p-v95v Argument Injection in Apache Geode server |
Medium EPSS 2.15% |
< 1.9.0 | 1.9.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor