Skip to content
OpenAdvisories
Critical · 9.8 CVE-2016-4000 EUVD-2022-2855GHSA-6r7r-jj8h-pq6vSNYK-JAVA-ORGPYTHON-31451

Deserialization of Untrusted Data in Jython

Published Jul 6, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: jython Package: jython Package: org.python:jython Package: org.python:jython-standalone Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jython 2.5.3-17 —
Debian 13 jython 2.5.3-17 —
Debian 12 jython 2.5.3-17 —
Debian 9 jython 2.5.3-16+deb9u1 DSA-3893-1
Debian 8 jython 2.5.3-3+deb8u1 DSA-3893-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 7 jython 2.5.2-1+deb7u1 DLA-989-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS jython 2.5.3-9ubuntu0.1 —
Ubuntu 14.04 LTS jython 2.5.3-1ubuntu0.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.python:jython < 2.7.1b3 2.7.1b3 GHSA-6r7r-jj8h-pq6v
Maven org.python:jython-standalone < 2.7.1b3 2.7.1b3 GHSA-6r7r-jj8h-pq6v

Advisories 2

References