GitHub Advisoryadvisory · Maven

GHSA-8qv5-68g4-248j Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization

CRITICAL Published 2022-09-25 Modified 2022-09-28 Official page ↗
Aliases
CVE-2022-36944
Ecosystem
Maven
Packages
org.scala-lang:scala-library
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-09-28

Affected packages

• Maven org.scala-lang:scala-library: >= 2.13.0, < 2.13.9 → fixed in 2.13.9

Description

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Related

Alias · CVE (1)

  • CVE-2022-36944 Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References