ALT-PU-2023-5825-2

Package update scala in branch sisyphus

Version2.13.9-alt1

Published2026-02-04

Max severityCRITICAL

Severity:

Closed issues (3)

CRITICAL9.8

Уязвимость интерпретатора языка программирования Scala, связанная с ошибками при десериализации данных, позволяющая нарушителю выполнить произвольный код

Published: 2023-01-17Modified: 2023-01-18

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 10.0

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

References

CVE-2022-36944

CRITICAL9.8

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Published: 2022-09-23Modified: 2025-05-27

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GHSA-8qv5-68g4-248j

CRITICAL9.8

Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization

Published: 2022-09-25Modified: 2022-09-28

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References