PkgSeer

Vulnerability GHSA-6r7r-jj8h-pq6v

Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 years ago
May 13, 2022 at 01:25 AM UTC
Deserialization of Untrusted Data in Jython
2.2-beta1 and 2.2-beta2 and 2.2-rc1 and 2.2-rc3 and 2.2 and 2.2.1 and 2.5.0 and 2.5.3-rc1 and 2.5.3 - 2.5.4-rc1 and 2.7-b1 and 2.7-b2 and 2.7-b3 and 2.7-b4 and 2.7-rc1 and 2.7-rc2 and 2.7-rc3 and 2.7.0 - 2.7.1b1 and 2.7.1b2
2.2-beta1 and 2.2-beta2 and 2.2-rc1 and 2.2-rc3 and 2.2 and 2.2.1 and 2.5.0 and 2.5.3-rc1 and 2.5.3 - 2.5.4-rc1 and 2.7-b1 and 2.7-b2 and 2.7-b3 and 2.7-b4 and 2.7-rc1 and 2.7-rc2 and 2.7-rc3 and 2.7.0 - 2.7.1b1 and 2.7.1b2

Summary

Deserialization of Untrusted Data in Jython

Details

Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk
4 years ago
Jython Improper Access Restrictions vulnerability
2.5.1 - 2.5.3-rc1 and 2.5.3 - 2.5.4-rc1 and 2.7-b1 and 2.7-b2 and 2.7-b3 and 2.7-b4 and 2.7-rc1 and 2.7-rc2 and 2.7-rc3 and 2.7.0 - 2.7.1b1 and 2.7.1b2 and 2.7.1b3 and 2.7.1-rc2 and 2.7.1-rc3 and 2.7.1 - 2.7.2b2 GHSA-9347-9w64-q5wp
2.5.1 - 2.5.3-rc1 and 2.5.3 - 2.5.4-rc1 and 2.7-b1 and 2.7-b2 and 2.7-b3 and 2.7-b4 and 2.7-rc1 and 2.7-rc2 and 2.7-rc3 and 2.7.0 - 2.7.1b1 and 2.7.1b2 and 2.7.1b3 and 2.7.1-rc2 and 2.7.1-rc3 and 2.7.1 - 2.7.2b2 GHSA-9347-9w64-q5wp
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
4 years ago
May 13, 2022 at 01:25 AM UTC
Last Modified
2 hours ago
November 12, 2026 at 10:55 AM UTC