CVE-2025-47771

描述

### Impact _What kind of vulnerability is it? Who is impacted?_ This is a disclosure for a security vulnerability in the `SparseMatrix` class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the `read` method of the `SparseMatrix` class. This method takes in an `InputStream` and returns a `SparseMatrix` object. We consider this to be a method that can be exposed to untrusted input in at least two use cases: - A user can adopt this method in an application where users can submit an `InputStream` and the application parses it into a `SparseMatrix`. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the `InputStream` from external sources. #### Am I impacted? You are vulnerable if you import non-controlled serialized `SparseMatrix` objects. ### Patches com.powsybl:powsybl-math:6.7.2 and higher ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Do not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods). ### References [powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)

如何修補 CVE-2025-47771

要修補 CVE-2025-47771,請將受影響套件升級到下列已修補版本。

• —升級至 6.7.2 或更新版本

CVE-2025-47771 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 6.3.0, < 6.7.2

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-47771
• PATCHgithub.com/powsybl/powsybl-core
• WEBgithub.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd
• WEBgithub.com/powsybl/powsybl-core/releases/tag/v6.7.2