This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GeoServer and GeoTools fix 2 vulnerabilities
GeoServer and GeoTools fix 2 vulnerabilities. The fix is available in versions 2.23.6, 2.24.4 and 2.25.2 for GeoServer and in versions 31.2, 30.4 and 29.6 for GeoTools [1][2].
An unauthenticated remote attacker is allowed to execute code in GeoServer without authorization by sending specially crafted OGC requests. The vulnerability is exploitable only if the application uses functionality from "gt-complex", so as a temporary fix the file "gt-complex-x.y.jar" can be deleted, which may however affect the overall functionality of the product. More information on the temporary fix can be found at [1].
The vulnerability is present in product:
- GeoServer; >= 2.24.0, < 2.24.4; >= 2.25.0, < 2.25.2; < 2.23.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-36401 at cve.org, NVD
- CWE-95 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 7. 2024.
An unauthenticated remote attacker is allowed to execute code in GeoTools without authorization. The vulnerability is exploitable only if the application uses functionality from "gt-complex", so as a temporary fix the file "gt-complex-x.y.jar" can be deleted, which may however affect the overall functionality of the product [2]. More information on the temporary fix and a PoC can be found at [2].
The vulnerability is present in product:
- GeoTools; >= 30.0, < 30.4; >= 31.0, < 31.2; < 29.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-36404 at cve.org, NVD
- CWE-95 at cwe.mitre.org
The vulnerability was publicly disclosed 2. 7. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 9. 7. 2024.