Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Affected: Maven: org.scala-lang:scala-library

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

jackson-databind: denial of service via a large depth of nested objects okhttp: information disclosure via improperly used cryptographic function netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode netty: world readable temporary file containing sensitive data scala: deserialization gadget chain jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or JSON data jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays Streams: component version with information disclosure flaw json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: scala, Ubuntu:Pro:18.04:LTS: scala, Ubuntu:Pro:20.04:LTS: scala, Ubuntu:22.04:LTS: scala, Ubuntu:24.04:LTS: scala, Ubuntu:25.04: scala

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Camunda ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.