Catalogue CVE

CVE-2023-37895

jackrabbit affected and fixed versions

[Catalogue CVE]

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone. The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control. Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:         <servlet>             <servlet-name>RMI</servlet-name>             <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class>         </servlet>         <servlet-mapping>             <servlet-name>RMI</servlet-name>             <url-pattern>/rmi</url-pattern>         </servlet-mapping> Find the bootstrap.properties file (in $REPOSITORY_HOME), and set         rmi.enabled=false     and also remove         rmi.host         rmi.port         rmi.url-pattern  If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.

Gravité
Low
Published
Source
[NVD] · [CVE record]
EPSS
3.24% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiejackrabbit2.20.11-1FixedDistribution-reported fixed boundary[CVE-2023-37895]
Debiantrixiejackrabbit2.20.11-1.1Fixed[CVE-2023-37895]
Debiansidjackrabbit2.20.11-1FixedDistribution-reported fixed boundary[CVE-2023-37895]
Debiansidjackrabbit2.20.11-1.1Fixed[CVE-2023-37895]
Debianforkyjackrabbit2.20.11-1FixedDistribution-reported fixed boundary[CVE-2023-37895]
Debianforkyjackrabbit2.20.11-1.1Fixed[CVE-2023-37895]

Showing 6 fix observations. All 20 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedjackrabbitNot reportedUnknownSource applicability is not establishedProvider not reported
DebianbookwormjackrabbitNot reportedAffectedDistribution reports no fix[CVE-2023-37895]
Debianbookwormjackrabbit2.20.3-1Affected[CVE-2023-37895]
Debianforkyjackrabbit2.20.11-1FixedDistribution-reported fixed boundary[CVE-2023-37895]
Debianforkyjackrabbit2.20.11-1.1Fixed[CVE-2023-37895]
Debiansidjackrabbit2.20.11-1FixedDistribution-reported fixed boundary[CVE-2023-37895]
Debiansidjackrabbit2.20.11-1.1Fixed[CVE-2023-37895]
Debiantrixiejackrabbit2.20.11-1FixedDistribution-reported fixed boundary[CVE-2023-37895]
Debiantrixiejackrabbit2.20.11-1.1Fixed[CVE-2023-37895]
Ubuntu14.04jackrabbit2.3.6-1Affected[UBUNTU-CVE-2023-37895]
Ubuntu14.04jackrabbit2.3.6-1+deb8u1build0.14.04.1Affected[UBUNTU-CVE-2023-37895]
Ubuntu14.04jackrabbit2.3.6-1+deb8u2build0.14.04.1Affected[UBUNTU-CVE-2023-37895]
Ubuntu16.04jackrabbit2.10.1-1Affected[UBUNTU-CVE-2023-37895]
Ubuntu16.04jackrabbit2.10.1-2Affected[UBUNTU-CVE-2023-37895]
Ubuntu18.04jackrabbit2.12.6-1Affected[UBUNTU-CVE-2023-37895]
Ubuntu18.04jackrabbit2.14.4-1Affected[UBUNTU-CVE-2023-37895]
Ubuntu20.04jackrabbit2.18.0+r2.14.6-1Affected[UBUNTU-CVE-2023-37895]
Ubuntu22.04jackrabbit2.18.0+r2.14.6-1Affected[UBUNTU-CVE-2023-37895]
Ubuntu22.04jackrabbit2.20.3-1Affected[UBUNTU-CVE-2023-37895]
Ubuntu24.04jackrabbit2.20.11-1Affected[UBUNTU-CVE-2023-37895]
Original provider fields
{
  "package_releases": [
    {
      "name": "jackrabbit",
      "status": "fixed",
      "release": "sid",
      "version": "2.20.11-1.1"
    },
    {
      "name": "jackrabbit",
      "status": "fixed",
      "release": "forky",
      "version": "2.20.11-1.1"
    },
    {
      "name": "jackrabbit",
      "status": "fixed",
      "release": "trixie",
      "version": "2.20.11-1.1"
    },
    {
      "name": "jackrabbit",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.20.3-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "jackrabbit",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "2.20.11-1"
    },
    {
      "bug": null,
      "name": "jackrabbit",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "2.20.11-1"
    },
    {
      "bug": null,
      "name": "jackrabbit",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "2.20.11-1"
    },
    {
      "bug": null,
      "name": "jackrabbit",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "jackrabbit",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "jackrabbit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "2.3.6-1",
        "2.3.6-1+deb8u1build0.14.04.1",
        "2.3.6-1+deb8u2build0.14.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-37895",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-37895",
      "provider_updated_at": "2025-10-24T05:02:08Z"
    },
    {
      "name": "jackrabbit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "2.10.1-1",
        "2.10.1-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-37895",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-37895",
      "provider_updated_at": "2025-10-24T05:02:08Z"
    },
    {
      "name": "jackrabbit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.12.6-1",
        "2.14.4-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-37895",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-37895",
      "provider_updated_at": "2025-10-24T05:02:08Z"
    },
    {
      "name": "jackrabbit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.18.0+r2.14.6-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-37895",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-37895",
      "provider_updated_at": "2025-10-24T05:02:08Z"
    },
    {
      "name": "jackrabbit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2.18.0+r2.14.6-1",
        "2.20.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-37895",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-37895",
      "provider_updated_at": "2025-10-24T05:02:08Z"
    },
    {
      "name": "jackrabbit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "2.20.11-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-37895",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-37895",
      "provider_updated_at": "2025-10-24T05:02:08Z"
    }
  ]
}

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

  • [libjackrabbit-java]Inconnu

    Paquet source: [jackrabbit]

    Détails (2)

    • 2.20.3-1 · all · bookworm

      Affectée

      dsa · jackrabbit · debian · bookworm; dsa · jackrabbit · debian · 12

    • 2.20.3-1 · all · bookworm

      Affectée

      dsa · jackrabbit · debian · bookworm; dsa · jackrabbit · debian · 12

[Debian 13 (Trixie)]

  • [libjackrabbit-java]Inconnu

    Paquet source: [jackrabbit]

    Détails (2)

    • 2.20.11-1.1 · all · trixie

      Corrigée · Corrigée: 2.20.11-1

      dsa · jackrabbit · debian · 13

    • 2.20.11-1.1 · all · trixie

      Corrigée · Corrigée: 2.20.11-1

      dsa · jackrabbit · debian · 13

Observé:

Références

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]