[ GLSA 201710-28 ] Jython

[GLSA]

Gentoo Linux Security Advisory

Title: Jython: Arbitrary code execution (GLSA 201710-28)
Severity: normal
Exploitable: remote
Date: 2017-10-29
Bug(s): #621876
ID: 201710-28

Synopsis

A vulnerability in Jython may lead to arbitrary code execution.


Background

An implementation of Python written in Java.

Affected Packages

Package: dev-java/jython
Vulnerable: < 2.7.0-r2
Unaffected: >= 2.7.0-r2
Architectures: All supported architectures


Description

It was found that Jython is vulnerable to arbitrary code execution by
sending a serialized function to the deserializer.


Impact

Remote execution of arbitrary code by enticing a user to execute
malicious code.


Workaround

There is no known workaround at this time.

Resolution

All Jython users should upgrade to the latest version: