CVE-2017-5641

    Dashboard / Vulnerabilities / CVE-2017-5641

    CVE-2017-5641

    Published: 28 Dec 2017Last Modified: 10 Mar 2026

    Summary:

    Details: Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.

    References: http://mail-archives.apache.org/mod_mbox/flex-dev/201703.mbox/%3C6B86C8D0-6E36-48F5-AC81-4AB3978F6746%40c-ware.de%3E, http://www.securitytracker.com/id/1038273, http://www.securityfocus.com/bid/97383, , https://www.kb.cert.org/vuls/id/307983, https://www.zerodayinitiative.com/advisories/ZDI-22-507/, https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03823en_us, https://www.zerodayinitiative.com/advisories/ZDI-22-506/, https://issues.apache.org/jira/browse/FLEX-35290

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High