PT-2022-6144 · Scala+1 · Scala+1

Marc Bohler · Published 2022-09-23 · Updated 2023-10-22 · CVE-2022-36944

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Scala versions 2.13.x before 2.13.9

Description The issue is related to errors in data deserialization. It may allow a remote attacker to execute arbitrary code, erase the contents of arbitrary files, or make network connections via a gadget chain, specifically exploiting Function0 functions. This risk exists when Java object deserialization or LazyList object deserialization occurs within an application.

Recommendations For Scala versions 2.13.x before 2.13.9, update to version 2.13.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of Java object deserialization and LazyList object deserialization within applications to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2023-5825

ALT-PU-2023-6353

BDU:2023-00169

CVE-2022-36944

GHSA-8QV5-68G4-248J

Affected Products

Alt Linux

Scala

References · 19

• 🔥 https://github.com/scala/scala/pull/10118 · Exploit
• 🔥 https://github.com/yarocher/lazylist-cve-poc · Exploit
• https://scala-lang.org/download · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36944 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-36944 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-36944 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-36944 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00169 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-36944 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36944 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8qv5-68g4-248j · Vendor Advisory