Skip to content
OpenAdvisories
Critical · 9.1 CVE-2022-36437 EUVD-2022-7594GHSA-c5hg-mr8r-f6jp

Hazelcast connection caching

Published Dec 29, 2022 · Updated Apr 11, 2025 · Assigned by mitre

Package: com.hazelcast:hazelcast Package: com.hazelcast:hazelcast-enterprise Package: com.hazelcast.jet:hazelcast-jet Package: com.hazelcast.jet:hazelcast-jet-enterprise Ecosystem: Maven

Description

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.hazelcast:hazelcast < 3.12.13 3.12.13 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast >= 4.0, <= 4.0.6 — GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast >= 4.1, < 4.1.10 4.1.10 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast >= 4.2, < 4.2.6 4.2.6 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast >= 5.0, < 5.0.4 5.0.4 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast >= 5.1, < 5.1.3 5.1.3 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast-enterprise < 3.12.13 3.12.13 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast-enterprise >= 4.0, <= 4.0.6 — GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast-enterprise >= 4.1, < 4.1.10 4.1.10 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast-enterprise >= 4.2, < 4.2.6 4.2.6 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast-enterprise >= 5.0, < 5.0.4 5.0.4 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast:hazelcast-enterprise >= 5.1, < 5.1.3 5.1.3 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast.jet:hazelcast-jet < 4.5.4 4.5.4 GHSA-c5hg-mr8r-f6jp
Maven com.hazelcast.jet:hazelcast-jet-enterprise < 4.5.4 4.5.4 GHSA-c5hg-mr8r-f6jp

Advisories 2

References