GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2,
    30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools
    functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain
    a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the
    `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would
    not function without the ability to use XPath expressions to query complex content. Alternatively, one may
    utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2,
    27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven
    central, intended to quickly provide a fix to affected applications. (CVE-2024-36404)

The version of OSGeo GeoTools installed on the remote host is affected by a remote code execution vulnerability, as follows:

  - Remote Code Execution is possible if an application uses certain GeoTools functionality to evaluate XPath     expressions supplied by user input.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
433819	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Cloud Security	SCA Checks	critical
433819	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Self-Hosted Container Security	SCA Checks	critical
420825	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Cloud Security	SCA Checks	critical
420825	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Self-Hosted Container Security	SCA Checks	critical
204971	OSGeo GeoTools RCE (CVE-2024-36404)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2024-36404

critical

Tenable Plugins

critical

critical

critical

critical

critical