PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods).

Affected: Maven: com.powsybl:powsybl-math

### Impact _What kind of vulnerability is it? Who is impacted?_

This is a disclosure for a security vulnerability in the `SparseMatrix` class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the `read` method of the `SparseMatrix` class. This method takes in an `InputStream` and returns a `SparseMatrix` object. We consider this to be a method that can be exposed to untrusted input in at least two use cases: - A user can adopt this method in an application where users can submit an `InputStream` and the application parses it into a `SparseMatrix`. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the `InputStream` from external sources.

#### Am I impacted? You are vulnerable if you import non-controlled serialized `SparseMatrix` objects.

### Patches com.powsybl:powsybl-math:6.7.2 and higher

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods).

### References [powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)