CVE-2020-17531: Deserialization of Untrusted Data
A Java Serialization vulnerability was found in Apache Tapestry Apache Tapestry 4 will attempt to deserialize the “sp” parameter even before invoking the page’s validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
References
- github.com/advisories/GHSA-c566-2grg-mjwg
- lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76%40%3Cusers.tapestry.apache.org%3E
- lists.apache.org/thread.html/r700a6aa234dbff0555d4187bdc8274d7e4c0afbf35b9a3457f09ee76@%3Cusers.tapestry.apache.org%3E
- nvd.nist.gov/vuln/detail/CVE-2020-17531
- security.netapp.com/advisory/ntap-20210115-0007/
Code Behaviors & Features
Detect and mitigate CVE-2020-17531 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →