CVE-2018-8013

CRITICAL9.8EPSS 1.2%

Deserialization of Untrusted Data in Apache Batik

發布日:2022/5/13修改日:2024/3/14
也稱為:GHSA-25gw-4pcc-45cfDEBIAN-CVE-2018-8013

描述

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

受影響套件(3)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(25)