Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA1Z20tZmdmeC1ocjdo

Gadget chain attack in Nippy

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.

Permalink: https://github.com/advisories/GHSA-p5gm-fgfx-hr7h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA1Z20tZmdmeC1ocjdo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00065
EPSS Percentile: 0.2952

Identifiers: GHSA-p5gm-fgfx-hr7h, CVE-2020-24164
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-24164
• https://github.com/ptaoussanis/nippy/issues/130
• https://github.com/ptaoussanis/nippy/commit/61fb009fdde2994140f2da2e495ba8af3a873eb2
• https://github.com/advisories/GHSA-p5gm-fgfx-hr7h

Repository: https://github.com/ptaoussanis/nippy
Blast Radius: 1.0

Affected Packages