PLEASE REMOVE ME FROM MAILING LIST

[SUSAN WEISSMAN]

RE: Request JIRA Ticket Assgin Permission

[Weijie Xu M]

Hi Dan,

  It works for me, and thank you for the info!

BRs/Xu Weijie

-Original Message-
From: Dan Smith  
Sent: Wednesday, August 31, 2022 2:29 AM
To: dev@geode.apache.org
Subject: Re: Request JIRA Ticket Assgin Permission

Hi Xu Weijie,

I gave you permission in JIRA, you should be able to assign that issue to 
yourself now.

If you haven't already seen it, here is our wiki page with some helpful 
information about how to contribute - 
https://cwiki.apache.org/confluence/display/GEODE/How+to+Contribute.

Thank you!
-Dan



From: Weijie Xu M 
Sent: Monday, August 29, 2022 3:33 AM
To: dev@geode.apache.org 
Subject: Request JIRA Ticket Assgin Permission

⚠ External Email

Hi community,

  I'm newcomer for geode contribution, and I want assign ticket [GEODE-10409] 
Rebalance Model Missing Collocated Regions At Server Startup - ASF JIRA 
(apache.org)
 to myself.
  Could you help give me assign permission for JIRA tickets? Thanks.

BRs/Xu Weijie



⚠ External Email: This email originated from outside of the organization. Do 
not click links or open attachments unless you recognize the sender.

Re: Request JIRA Ticket Assgin Permission

[Dan Smith]

Hi Xu Weijie,

I gave you permission in JIRA, you should be able to assign that issue to 
yourself now.

If you haven't already seen it, here is our wiki page with some helpful 
information about how to contribute - 
https://cwiki.apache.org/confluence/display/GEODE/How+to+Contribute.

Thank you!
-Dan



From: Weijie Xu M 
Sent: Monday, August 29, 2022 3:33 AM
To: dev@geode.apache.org 
Subject: Request JIRA Ticket Assgin Permission

⚠ External Email

Hi community,

  I'm newcomer for geode contribution, and I want assign ticket [GEODE-10409] 
Rebalance Model Missing Collocated Regions At Server Startup - ASF JIRA 
(apache.org)
 to myself.
  Could you help give me assign permission for JIRA tickets? Thanks.

BRs/Xu Weijie



⚠ External Email: This email originated from outside of the organization. Do 
not click links or open attachments unless you recognize the sender.

CVE-2022-37023: Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11

[Kirk Lund]

Severity: high - possible RCE

Description:

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of 
untrusted data flaw when using REST API on Java 8 or Java 11.

Any user wishing to protect against deserialization attacks involving REST APIs 
should upgrade to Apache Geode 1.15 and follow the documentation for details on 
enabling "validate-serializable-objects=true" and specifying any user classes 
that may be serialized/deserialized with "serializable-object-filter". Enabling 
"validate-serializable-objects" may impact performance.

Mitigation:

Disable affected services such as JMX over RMI or REST APIs unless they are 
required. REST APIs can be disabled by setting `http-service-port` to zero.

CVE-2022-37022: Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11

[Kirk Lund]

Severity: high - possible RCE

Description:

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a 
deserialization of untrusted data flaw when using JMX over RMI on Java 11.

Any user wishing to protect against deserialization attacks involving JMX or 
RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will 
automatically protect JMX over RMI against deserialization attacks. This should 
have no impact on performance since it only affects JMX/RMI which Gfsh uses to 
communicate with the JMX Manager which is hosted on a Locator.

This issue is being tracked as GEODE-9064

Mitigation:

Disable affected services such as JMX over RMI unless they are required. JMX 
over RMI can be disabled by setting Geode property `jmx-manager` to false; this 
property defaults to false on Servers and true on Locators. 

CVE-2022-37021: Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.

[Kirk Lund]

Severity: high - possible RCE

Description:

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a 
deserialization of untrusted data flaw when using JMX over RMI on Java 8. 

Any user still on Java 8 who wishes to protect against deserialization attacks 
involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. 

If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and 
specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators 
or Servers. Follow the documentation for details on specifying any user classes 
that may be serialized/deserialized with the "serializable-object-filter" 
configuration option. Using a global serial filter will impact performance.

This issue is being tracked as GEODE-9758

Mitigation:

Disable affected services such as JMX over RMI unless they are required. JMX 
over RMI can be disabled by setting Geode property `jmx-manager` to false; this 
property defaults to false on Servers and true on Locators.