GitHub Advisoryadvisory · NuGet

GHSA-ww7r-278h-48mh QuantConnect Lean vulnerable to insecure deserialization

CRITICAL Published 2022-05-24 Modified 2023-07-20 Official page ↗
Aliases
CVE-2020-20136
Ecosystem
NuGet
Packages
QuantConnect.Common
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-07-20

Affected packages

• NuGet QuantConnect.Common: >= 2.3.0.0, <= 2.4.0.1 (no fix yet)

Description

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library. One may avoid this issue by only running Lean in an environment where data provided is trusted.

Related

Alias · CVE (1)

  • CVE-2020-20136 QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References