CVE-2022-36944 : Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There i

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Published 2022-09-23 18:15:11

Updated 2023-07-27 15:19:34

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-36944

Fedoraproject » Fedora » Version: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Matching versions
Scala-lang » Scala
Versions from including (>=) 2.13.0 and before (<) 2.13.9
cpe:2.3:a:scala-lang:scala:*:*:*:*:*:*:*:*
Matching versions
Scala-lang » Scala-collection-compat
Versions before (<) 2.9.0
cpe:2.3:a:scala-lang:scala-collection-compat:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-36944

EPSS FAQ

0.75%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-36944

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	N/A	N/A	Oracle:CPUOct2023
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-36944

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-36944

https://www.scala-lang.org/download/

Install | The Scala Programming Language
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/

[SECURITY] Fedora 35 Update: scala-2.13.9-1.fc35 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/scala/scala/pull/10118

For security, prevent `Function0` execution during `LazyList` deserialization by lrytz · Pull Request #10118 · scala/scala · GitHub
Exploit;Patch;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/

[SECURITY] Fedora 36 Update: scala-2.13.9-1.fc36 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0

Release 2.9.0 · scala/scala-collection-compat · GitHub
Release Notes;Third Party Advisory
https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2

Impact of CVE-2022-36944 on akka-cluster, akka-actor, akka-remote - Akka / Akka Cluster - Discussion Forum for Akka Platform technologies
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-36944

Products affected by CVE-2022-36944

Exploit prediction scoring system (EPSS) score for CVE-2022-36944

CVSS scores for CVE-2022-36944

CWE ids for CVE-2022-36944

References for CVE-2022-36944