Deserialization in Apache Batik
CVE-2018-8013
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.189 (97.3th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.189 · newest: 0.189 · change: 0.000
Affected products
- Apache Batik
- Apache Software Foundation Batik — versions 1.0 - 1.9.1
- Oracle Business Intelligence — versions 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0
- Oracle Communications Diameter Signaling Router
- Oracle Communications Metasolv Solution — versions 6.3.0
- Oracle Communications Webrtc Session Controller
- Oracle Data Integrator — versions 12.2.1.3.0
- Oracle Enterprise Repository — versions 11.1.1.7.0, 12.1.3.0.0
- Oracle Financial Services Analytical Applications Infrastructure
- Oracle Fusion Middleware Mapviewer — versions 12.2.1.2, 12.2.1.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/104252 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.debian.org/debian-lts-announce/2018/05/msg00016.html (mailing-list, Mailing List, Third Party Advisory)
- www.debian.org/security/2018/dsa-4215 (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/3661-1/ (vendor-advisory, Third Party Advisory)
- mail-archives.apache.org/mod_mbox/xmlgraphics-batik-dev/201805.mbox/<000701d3f2… (mailing-list)
- www.securitytracker.com/id/1040995 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.apache.org/thread.html/r9e90b4d1cf6ea87a79bb506541140dfbf4801f4463a7cee08… (mailing-list)
- lists.apache.org/thread.html/rc0a31867796043fbe59113fb654fe8b13309fe04f8935acb8… (mailing-list)
- www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html (Patch, Third Party Advisory)
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-8013?
- CVE-2018-8013 is a critical-severity vulnerability in Apache Batik, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2018-05-24.
- How severe is CVE-2018-8013?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2018-8013 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.