Описание
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| gradle | fixed | 2.13-1 | package | |
| gradle | ignored | jessie | package |
Примечания
Starting from 2.13-1 it uses commons-collections:commons-collections:3.2.2
https://philwantsfish.github.io/security/java-deserialization-github
https://discuss.gradle.org/t/a-security-issue-about-gradle-rce/17726
ObjectSocketWrapper only used by Gradle UI, which was removed in current releases (4.x)
EPSS
Связанные уязвимости
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
EPSS