Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction w...
概要
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory nvd.nist.gov
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- package github.com
- patch github.com
- web discuss.lightbend.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web scala-lang.org
- web scala-lang.org