CVE catalog

CVE-2013-1768

openjpa: CVE-2013-1768

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
9.51% · Oct 25, 2026

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenjpasid2.4.2-9fixed
Debianopenjpaforky2.4.2-9fixed
Debianopenjpatrixie2.4.2-9fixed
Debianopenjpabookworm2.4.2-8fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenjpasourcesid2.2.2-1not yet assignedNot reported[716937]
Debianopenjpasourceforky2.2.2-1not yet assignedNot reported[716937]
Debianopenjpasourcetrixie2.2.2-1not yet assignedNot reported[716937]
Debianopenjpasourcebookworm2.2.2-1not yet assignedNot reported[716937]

[Debian bug #716937]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libopenjpa-java]Fixed

    Source package: [openjpa]

    Details (2)

    • 2.4.2-8 · all · bookworm

      Fixed · Fixed: 2.2.2-1

      dsa · openjpa · debian · bookworm; dsa · openjpa · debian · 12

    • 2.4.2-8 · all · bookworm

      Fixed · Fixed: 2.2.2-1

      dsa · openjpa · debian · bookworm; dsa · openjpa · debian · 12

[Debian 13 (Trixie)]

  • [libopenjpa-java]Fixed

    Source package: [openjpa]

    Details (2)

    • 2.4.2-9 · all · trixie

      Fixed · Fixed: 2.2.2-1

      dsa · openjpa · debian · 13

    • 2.4.2-9 · all · trixie

      Fixed · Fixed: 2.2.2-1

      dsa · openjpa · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]