vulnwire
9.8crit

CVE-2016-4000

Deserialization of Untrusted Data in Jython

Also known as GHSA-6r7r-jj8h-pq6v

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.2%
percentile 94%
Public exploits
0
none known

Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

Exploit prediction (EPSS)

6.21% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.python:jython-standalone
<2.7.1b3
2.7.1b3
mavenorg.python:jython
<2.7.1b3
2.7.1b3

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

  • debian.org /security/2017/dsa-3893 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201710-28 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityfocus.com /bid/105647 · vdb-entry, x_refsource_BID, x_transferred
  • lists.apache.org /thread.html/0919ec1db20b1022f22b8e78f355667df74d6142b463ff17d03ad533%40%3Cdevnull.infra.a · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /security-alerts/cpuapr2020.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /security-alerts/cpujul2020.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpujan2019-5072801.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2019-5072813.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2019-5072832.html · x_refsource_MISC, x_transferred
  • oracle.com /security-alerts/cpujan2020.html · x_refsource_MISC, x_transferred
  • security-tracker.debian.org /tracker/CVE-2016-4000 · x_refsource_MISC, x_transferred
  • hg.python.org /jython/rev/d06e29d100c0 · x_refsource_CONFIRM, x_transferred
  • snyk.io /vuln/SNYK-JAVA-ORGPYTHON-31451 · x_refsource_MISC, x_transferred
  • bugs.jython.org /issue2454 · x_refsource_CONFIRM, x_transferred
  • hg.python.org /jython/file/v2.7.1rc1/NEWS · x_refsource_CONFIRM, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=864859 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-4000 · advisory
  • github.com /jython/jython/commit/ee4200fdd5385d3f74a5cf1a781fa52d33bbb274 · web
  • lists.apache.org /thread.html/0919ec1db20b1022f22b8e78f355667df74d6142b463ff17d03ad533@%3Cdevnull.infra.apa · web
  • github.com /jython/jython · package
  • bugs.jython.org /issue2454 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.