GHSA-76mw-6p95-x9x5

Suggest an improvement
Source
https://github.com/advisories/GHSA-76mw-6p95-x9x5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-76mw-6p95-x9x5/GHSA-76mw-6p95-x9x5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-76mw-6p95-x9x5
Aliases
  • CVE-2023-25581
Published
2024-10-11T22:16:56Z
Modified
2024-10-14T18:44:38.309922Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
pac4j-core affected by a Java deserialization vulnerability
Details

pac4j is a security framework for Java. pac4j-core prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the UserProfile class from pac4j-core. It can be exploited by providing an attribute that contains a serialized Java object with a special prefix {#sb64} and Base64 encoding. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a RestrictedObjectInputStream is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "nvd_published_at": "2024-10-10T16:15:04Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-11T22:16:56Z"
}
References

Affected packages

Maven / org.pac4j:pac4j-core

Package

Name
org.pac4j:pac4j-core
View open source insights on deps.dev
Purl
pkg:maven/org.pac4j/pac4j-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.0

Affected versions

1.*

1.4.0
1.4.1
1.5.0
1.5.1
1.6.0-RC1
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0-RC1
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9

2.*

2.0.0-RC1
2.0.0-RC2
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1

3.*

3.0.0-RC1
3.0.0-RC2
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.6.0
3.6.1
3.7.0
3.8.0
3.8.1
3.8.2
3.8.3
3.9.0

4.*

4.0.0-RC1
4.0.0-RC2
4.0.0-RC3