Vulnerability Description
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Scala-Lang | Scala | >= 2.13.0, < 2.13.9 |
| Scala-Lang | Scala-Collection-Compat | < 2.9.0 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-acThird Party Advisory
- https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0Release NotesThird Party Advisory
- https://github.com/scala/scala/pull/10118ExploitPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.scala-lang.org/download/Vendor Advisory
- https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-acThird Party Advisory
- https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0Release NotesThird Party Advisory
- https://github.com/scala/scala/pull/10118ExploitPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.scala-lang.org/download/Vendor Advisory
FAQ
What is CVE-2022-36944?
CVE-2022-36944 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an applicat...
How severe is CVE-2022-36944?
CVE-2022-36944 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-36944?
Check the references section above for vendor advisories and patch information. Affected products include: Scala-Lang Scala, Scala-Lang Scala-Collection-Compat, Fedoraproject Fedora.