Описание
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
A flaw was found in Scala's LazyList that permits code execution during deserialization. This issue could allow an attacker to craft a LazyList containing a malicious Function0 call to execute arbitrary code on a server that deserializes untrusted data.
Меры по смягчению последствий
Users of Scala's LazyList should never permit deserialization of untrusted data.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | scala | Under investigation | ||
| Red Hat Fuse 7 | scala | Not affected | ||
| Red Hat JBoss Data Grid 7 | scala | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | scala-library | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | scala-library | Not affected | ||
| Red Hat JBoss Fuse 6 | scala | Not affected | ||
| Red Hat JBoss Fuse Service Works 6 | scala | Out of support scope | ||
| Red Hat AMQ Streams 2.4.0 | scala | Fixed | RHSA-2023:3223 | 18.05.2023 |
| Red Hat AMQ Streams 2.5.0 | Fixed | RHSA-2023:5165 | 14.09.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR ...
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Уязвимость интерпретатора языка программирования Scala, связанная с ошибками при десериализации данных, позволяющая нарушителю выполнить произвольный код
EPSS
8.1 High
CVSS3