Bug 872695 – dev-lang/scala <dev-lang/scala-bin-2.13.9: deserialization gadget chain

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-09-24 19:59:42 UTC]

CVE-2022-36944:

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

This seems to only be a mitigation against certain kinds of
vulnerabilities in Scala programs, so no GLSA. Please bump.

[Comment 1 Larry the Git Cow 2022-09-28 15:39:54 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e35d7d6b7a1e56e29fb6e515693208ab0ba370c9

commit e35d7d6b7a1e56e29fb6e515693208ab0ba370c9
Author:     Florian Schmaus <[e-mail]>
AuthorDate: 2022-09-28 15:38:31 +0000
Commit:     Florian Schmaus <[e-mail]>
CommitDate: 2022-09-28 15:39:46 +0000

    dev-lang/scala-bin: add 2.13.9
    
    Bug: https://bugs.gentoo.org/872695
    Signed-off-by: Florian Schmaus <[e-mail]>

 dev-lang/scala-bin/Manifest                |  1 +
 dev-lang/scala-bin/scala-bin-2.13.9.ebuild | 77 ++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+)

[Comment 2 John Helmert III 2022-09-28 22:50:16 UTC]

Thanks Flow! Not sure how I missed the existence of scala-bin.

I'm not sure if we can trust the CVE's assertion that this only affects Scala 2.13.x, so keeping at [ebuild] for now for dev-lang/scala itself. Please stabilize scala-bin-2.13.9 when ready.

[Comment 3 Larry the Git Cow 2023-06-29 06:09:17 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0e44201d7f3ae177c3b8449d53e55fa71ff229c7

commit 0e44201d7f3ae177c3b8449d53e55fa71ff229c7
Author:     Volkmar W. Pogatzki <[e-mail]>
AuthorDate: 2023-06-28 17:55:24 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2023-06-29 06:08:55 +0000

    dev-lang/scala-bin: drop 2.13.6
    
    Bug: https://bugs.gentoo.org/872695
    Signed-off-by: Volkmar W. Pogatzki <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/31661
    Signed-off-by: Miroslav Šulc <[e-mail]>

 dev-lang/scala-bin/Manifest                |  1 -
 dev-lang/scala-bin/scala-bin-2.13.6.ebuild | 77 ------------------------------
 2 files changed, 78 deletions(-)

[Comment 4 John Helmert III 2023-07-05 15:50:44 UTC]

Actually, it looks like LazyLists are a 2.13 feature of Scala, so scala itself isn't affected. All done.