GitHub Advisoryadvisory · Maven
GHSA-mm57-9j6q-rxm2 Akka Java Serialization vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2017-1000034
- Ecosystem
- Maven
- Packages
- com.typesafe.akka:akka-actor
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2020-06-16
Affected packages
• Maven com.typesafe.akka:akka-actor: < 2.4.17 → fixed in 2.4.17
Description
Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.
Related
Alias · CVE (1)
- CVE-2017-1000034 Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code… vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000034 advisory
- https://github.com/akka/akka/issues/22283 web
- https://github.com/akka/akka/commit/cc6561b47e5958923df520b8a9514010d3e11d49 web
- https://github.com/advisories/GHSA-mm57-9j6q-rxm2 advisory
- http://doc.akka.io/docs/akka/2.4/security/2017-02-10-java-serialization.html web