Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction w...
Summary
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Original description
The description as published by the source.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- package github.com
- patch github.com
- web discuss.lightbend.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web scala-lang.org
- web scala-lang.org