CVE-2022-36944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-36944
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2 Third Party Advisory
https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0 Release Notes Third Party Advisory
https://github.com/scala/scala/pull/10118 Exploit Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/
https://www.scala-lang.org/download/ Vendor Advisory
https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2 Third Party Advisory
https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0 Release Notes Third Party Advisory
https://github.com/scala/scala/pull/10118 Exploit Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/
https://www.scala-lang.org/download/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:scala-lang:scala:*:*:*:*:*:*:*:*
cpe:2.3:a:scala-lang:scala-collection-compat:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
History

21 Nov 2024, 07:14

Type Values Removed Values Added
References () https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2 - Third Party Advisory () https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2 - Third Party Advisory
References () https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0 - Release Notes, Third Party Advisory () https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0 - Release Notes, Third Party Advisory
References () https://github.com/scala/scala/pull/10118 - Exploit, Patch, Third Party Advisory () https://github.com/scala/scala/pull/10118 - Exploit, Patch, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/ -
References () https://www.scala-lang.org/download/ - Vendor Advisory () https://www.scala-lang.org/download/ - Vendor Advisory

27 Jul 2023, 15:19

Type Values Removed Values Added
References
  • (MISC) https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0 - Release Notes, Third Party Advisory
CPE cpe:2.3:a:scala-lang:scala-collection-compat:*:*:*:*:*:*:*:*

08 Nov 2022, 02:57

Type Values Removed Values Added
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/ - Mailing List, Third Party Advisory
References (MISC) https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2 - (MISC) https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2 - Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

12 Oct 2022, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-09-23 18:15

Updated : 2024-11-21 07:14

NVD link : CVE-2022-36944

Mitre link : CVE-2022-36944

CVE.ORG link : CVE-2022-36944

JSON object : View

Products Affected

scala-lang

  • scala
  • scala-collection-compat

fedoraproject

  • fedora
CWE
CWE-502

Deserialization of Untrusted Data