Описание
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
Меры по смягчению последствий
- Use "scala -nocompdaemon MyScript.scala" rather than "scala MyScript.scala" to disable the implicit startup and use of the daemon.
- Avoid explicitly starting fsc. This text is borrowed from the upstream security advisory.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| JBoss Developer Studio 10 | scala-compiler | Not affected | ||
| JBoss Developer Studio 10 | scala-library | Not affected | ||
| JBoss Developer Studio 8 | scala-library | Not affected | ||
| Red Hat JBoss A-MQ 6 | scala-library | Not affected | ||
| Red Hat JBoss Data Grid 6 | scala-library | Will not fix | ||
| Red Hat JBoss Data Grid 7 | scala-library | Not affected | ||
| Red Hat JBoss Data Virtualization 6 | scala-library | Not affected | ||
| Red Hat JBoss Fuse 6 | Camel | Not affected | ||
| Red Hat JBoss Fuse Service Works 6 | camel-scala | Will not fix | ||
| Red Hat JBoss Fuse Service Works 6 | scala-compiler | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
6.7 Medium
CVSS3
Связанные уязвимости
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, ...
High severity vulnerability that affects org.scala-lang:scala-compiler
EPSS
6.7 Medium
CVSS3