GHSA-p5gm-fgfx-hr7h
Gadget chain attack in Nippy
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.taoensso:nippy | < 2.14.2 | 2.14.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.
References
External links from the advisory. They lead to third-party sites.