Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction w...
Résumé
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory nvd.nist.gov
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- package github.com
- patch github.com
- web discuss.lightbend.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web scala-lang.org
- web scala-lang.org