GCVE - cpe:2.3:a:apache:geronimo:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:geronimo:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Geronimo (`c9684310-70da-51ab-a5fc-96be416ae41b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:apache/geronimo`	purl2cpe	2026-06-01 10:14:26.625144
`pkg:cpan/geronimo`	purl2cpe	2026-06-01 10:14:26.625147
`pkg:deb/debian/geronimo-concurrent-1.0-spec`	purl2cpe	2026-06-01 10:14:26.625150
`pkg:deb/ubuntu/geronimo-concurrent-1.0-spec`	purl2cpe	2026-06-01 10:14:26.625158
`pkg:github/apache/geronimo`	purl2cpe	2026-06-01 10:14:26.625161
`pkg:maven/geronimo/geronimo`	purl2cpe	2026-06-01 10:14:26.625164
`pkg:maven/geronimo/geronimo-core`	purl2cpe	2026-06-01 10:14:26.625167
`pkg:maven/org.apache.geronimo/geronimo`	purl2cpe	2026-06-01 10:14:26.625169

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-5034`	vulnerable	2026-06-08 04:59:34.253570	Details available Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461. Published: 2011-12-30T01:00:00.000Z Updated: 2024-08-07T00:23:39.535Z Open on db.gcve.eu Reference links https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py http://www.nruns.com/_downloads/advisory28122011.pdf http://secunia.com/advisories/47412 http://www.kb.cert.org/vuls/id/903934 http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1632`	not_vulnerable	2026-06-08 04:54:09.495533	Details available Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService. Published: 2010-06-22T20:24:00.000Z Updated: 2024-08-07T01:28:41.797Z Open on db.gcve.eu Reference links http://markmail.org/message/e4yiij7lfexastvl http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html http://www-1.ibm.com/support/docview.wss?uid=swg1PM14844 http://www.vupen.com/english/advisories/2010/1528 http://www-1.ibm.com/support/docview.wss?uid=swg1PM14765	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-0732`	vulnerable	2026-06-08 04:50:17.659351	Details available The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories. Published: 2008-02-12T20:00:00.000Z Updated: 2024-09-17T00:20:57.235Z Open on db.gcve.eu Reference links http://secunia.com/advisories/28838 http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.