PT-2016-3147 · Jython · Jython

Published 2016-01-19 · Updated 2022-05-13 · CVE-2016-4000

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jython versions prior to 2.7.1rc1

Description The issue is related to the restoration of untrusted data in memory, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted serialized PyFunction object. This can potentially allow the execution of arbitrary code.

Recommendations For versions prior to 2.7.1rc1, update to version 2.7.1rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of serialized PyFunction objects until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2017-01747

CVE-2016-4000

DLA-989-1

DSA-3893-1

GHSA-6R7R-JJ8H-PQ6V

SNYK-JAVA-ORGPYTHON-31451

Affected Products

Jython

References · 27

• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4000 · Vendor Advisory
• http://debian.org/security/2017/dsa-3893 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6r7r-jj8h-pq6v · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3893-1 · Vendor Advisory
• http://bugs.jython.org/issue2454 · Vendor Advisory
• https://hg.python.org/jython/rev/d06e29d100c0 · Patch
• https://cve.org/CVERecord?id=CVE-2016-4000 · Security Note
• https://bdu.fstec.ru/vul/2017-01747 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4000 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4000 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4000 · Vendor Advisory
• https://security.gentoo.org/glsa/201710-28 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4000 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Note