CVE-2022-36944
1 advisory.
Maven/org.scala-lang:scala-library CVE-2022-36944: critical 9.8
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Action: Upgrade org.scala-lang:scala-library to 2.13.9 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.13.0 | 2.13.9 | - |
Fixed versions
| 2.13.9 |
Sources
- osv: GHSA-8qv5-68g4-248j
- https://nvd.nist.gov/vuln/detail/CVE-2022-36944
- https://github.com/scala/scala/pull/10118
- https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2
- https://github.com/scala/scala
- https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0
- https://github.com/scala/scala/releases/tag/v2.13.9
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI
- https://www.scala-lang.org/download
CVE-2022-36944 · published · modified · JSON