Description
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
Remediation
References
http://www.openwall.com/lists/oss-security/2017/05/22/2
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Related Vulnerabilities
CVE-2022-37616 Vulnerability in maven package org.webjars.npm:xmldom__xmldom
CVE-2021-36774 Vulnerability in maven package org.apache.kylin:kylin-core-common
CVE-2021-4231 Vulnerability in npm package @angular/core
CVE-2017-12612 Vulnerability in maven package org.apache.spark:spark-core_2.10
CVE-2021-35516 Vulnerability in maven package org.apache.commons:commons-compress