Описание
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Ссылки
- Third Party Advisory
- Release NotesThird Party Advisory
- ExploitPatchThird Party Advisory
- Vendor Advisory
- Third Party Advisory
- Release NotesThird Party Advisory
- ExploitPatchThird Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
9.8 Critical
CVSS3
Дефекты
Связанные уязвимости
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR ...
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Уязвимость интерпретатора языка программирования Scala, связанная с ошибками при десериализации данных, позволяющая нарушителю выполнить произвольный код
EPSS
9.8 Critical
CVSS3