{"id":"GHSA-7q8c-49f4-4c8q","summary":"Solon vulnerable to deserialization of untrusted data","details":"A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.","aliases":["CVE-2023-35839"],"modified":"2024-03-07T21:46:22.317062Z","published":"2023-06-19T03:30:18Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2023-06-20T16:09:20Z","nvd_published_at":"2023-06-19T01:15:08Z","cwe_ids":["CWE-502"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35839"},{"type":"WEB","url":"https://github.com/noear/solon/issues/145"},{"type":"PACKAGE","url":"https://github.com/noear/solon"},{"type":"WEB","url":"https://github.com/noear/solon/compare/v2.3.2...v2.3.3"}],"affected":[{"package":{"name":"org.noear:solon","ecosystem":"Maven","purl":"pkg:maven/org.noear/solon"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3"}]}],"versions":["1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.14.1","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.2.1","1.0.2.10","1.0.2.11","1.0.2.12","1.0.2.13","1.0.2.14","1.0.2.15","1.0.2.17","1.0.2.18","1.0.2.19","1.0.2.7","1.0.2.8","1.0.2.9","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.3.1","1.0.3.10","1.0.3.11","1.0.3.12","1.0.3.15","1.0.3.16","1.0.3.17","1.0.3.18","1.0.3.19","1.0.3.2","1.0.3.20","1.0.3.21","1.0.3.22","1.0.3.23","1.0.3.24","1.0.3.25","1.0.3.26","1.0.3.27","1.0.3.28","1.0.3.29","1.0.3.3","1.0.3.30","1.0.3.31","1.0.3.32","1.0.3.33","1.0.3.34","1.0.3.36","1.0.3.37","1.0.3.38","1.0.3.39","1.0.3.4","1.0.3.40","1.0.3.41","1.0.3.42","1.0.3.43","1.0.3.44","1.0.3.5","1.0.3.6","1.0.3.7","1.0.3.8","1.0.3.9","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.4.1","1.0.4.2","1.0.4.3","1.0.4.4","1.0.40","1.0.41","1.0.42","1.0.43","1.0.5","1.0.5.1","1.0.5.10","1.0.5.11","1.0.5.12","1.0.5.2","1.0.5.4","1.0.5.5","1.0.5.6","1.0.5.7","1.0.5.8","1.0.5.9","1.0.6","1.0.6.1","1.0.6.2","1.0.6.3","1.0.6.4","1.0.6.5","1.0.7","1.0.7.1","1.0.8","1.0.9","1.0.9.1","1.0.9.2","1.1","1.1.1","1.1.10","1.1.11","1.1.12","1.1.13","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.10.0","1.10.0-M1","1.10.0-M2","1.10.1","1.10.1-M1","1.10.1-M2","1.10.1-M3","1.10.1-M4","1.10.10","1.10.10-M1","1.10.10-M2","1.10.10-M3","1.10.11","1.10.11-M1","1.10.11-M2","1.10.12","1.10.13","1.10.13-M1","1.10.13-M2","1.10.14-M1","1.10.14-M2","1.10.14-M3","1.10.2","1.10.2-M1","1.10.2-M2","1.10.2-M3","1.10.3","1.10.3-M1","1.10.3-M2","1.10.3-M3","1.10.3-M4","1.10.3-M5","1.10.3-M6","1.10.3-M7","1.10.4","1.10.4-M1","1.10.4-M2","1.10.5","1.10.5-M1","1.10.5-M2","1.10.5-M3","1.10.5-M4","1.10.6","1.10.6-M1","1.10.6-M2","1.10.6-M3","1.10.6-M4","1.10.7","1.10.7-M1","1.10.7-M2","1.10.7-M3","1.10.8","1.10.8-M1","1.10.8-M2","1.10.8-M3","1.10.9","1.11.0","1.11.1","1.11.1-M1","1.11.1-M2","1.11.1-M3","1.11.1-M4","1.11.2","1.11.3","1.11.4","1.11.4-M1","1.11.4-M2","1.11.4-M3","1.11.4-M4","1.11.5","1.11.6","1.11.6-M1","1.11.6-M2","1.11.6-RC","1.11.7-M1","1.11.7-M2","1.12.0","1.12.0-M1","1.12.0-RC","1.12.1","1.12.1-M1","1.12.1-M2","1.12.1-M3","1.12.1-M4","1.12.1-M5","1.12.2","1.12.2-M1","1.12.2-M2","1.12.3","1.12.3-M1","1.12.3-M2","1.12.3-M3","1.12.3-M4","1.12.3-M5","1.12.3-M6","1.12.4","1.2","1.2.1","1.2.10","1.2.10.1","1.2.11","1.2.12","1.2.12.1","1.2.12.2","1.2.12.3","1.2.13","1.2.14","1.2.14.1","1.2.15","1.2.16","1.2.17","1.2.18","1.2.18.1","1.2.19","1.2.2","1.2.20","1.2.21","1.2.22","1.2.24","1.2.25","1.2.26","1.2.27","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.3.17","1.3.18","1.3.19","1.3.2","1.3.20","1.3.21","1.3.22","1.3.23","1.3.24","1.3.25","1.3.26","1.3.27","1.3.28","1.3.29","1.3.3","1.3.30","1.3.31","1.3.32","1.3.33","1.3.34","1.3.35","1.3.36","1.3.37","1.3.38","1.3.39","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.2","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.5.25","1.5.26","1.5.27","1.5.28","1.5.29","1.5.3","1.5.30","1.5.31","1.5.32","1.5.33","1.5.34","1.5.35","1.5.36","1.5.37","1.5.38","1.5.39","1.5.4","1.5.40","1.5.41","1.5.42","1.5.43","1.5.44","1.5.45","1.5.46","1.5.47","1.5.48","1.5.49","1.5.5","1.5.50","1.5.51","1.5.52","1.5.53","1.5.54","1.5.55","1.5.56","1.5.57","1.5.58","1.5.59","1.5.6","1.5.60","1.5.61","1.5.62","1.5.63","1.5.64","1.5.65","1.5.66","1.5.67","1.5.68","1.5.69","1.5.7","1.5.70","1.5.71","1.5.8","1.5.9","1.6.0","1.6.1","1.6.1-m1","1.6.10","1.6.11","1.6.11-m1","1.6.11-m2","1.6.11-m3","1.6.12","1.6.12-m1","1.6.12-m2","1.6.12-m3","1.6.12-m4","1.6.13","1.6.13-m1","1.6.13-m2","1.6.14","1.6.14-m1","1.6.14-m2","1.6.15","1.6.15-m1","1.6.15-m2","1.6.15-m3","1.6.15-m4","1.6.15-m5","1.6.16","1.6.16-m1","1.6.16-m2","1.6.16-m3","1.6.16-m4","1.6.17","1.6.17-m1","1.6.18","1.6.19","1.6.19-m1","1.6.19-m2","1.6.2","1.6.20","1.6.21","1.6.21-m1","1.6.21-m2","1.6.22","1.6.23","1.6.23-m1","1.6.24","1.6.25","1.6.25-m1","1.6.25-m2","1.6.26","1.6.26-m1","1.6.27","1.6.27-m1","1.6.27-m2","1.6.28","1.6.29","1.6.29-m1","1.6.29-m2","1.6.3","1.6.30","1.6.30-m1","1.6.30-m2","1.6.30-m3","1.6.31","1.6.31-m1","1.6.31-m2","1.6.31-m3","1.6.31-m4","1.6.32","1.6.33","1.6.33-m1","1.6.34","1.6.34-m1","1.6.34-m2","1.6.34-m3","1.6.35","1.6.35-m1","1.6.35-m2","1.6.35-m3","1.6.35-m4","1.6.36","1.6.37-m1","1.6.37-m2","1.6.37-m3","1.6.37-m4","1.6.4","1.6.5","1.6.6","1.6.6-m1","1.6.6-m2","1.6.6-m3","1.6.7","1.6.7-m1","1.6.8","1.6.8-m1","1.6.8-m2","1.6.8-m3","1.6.9","1.6.9-m1","1.6.9-m2","1.6.9-m3","1.6.9-m4","1.6.9-m5","1.6.9-m6","1.7.0","1.7.1","1.7.2","1.7.2-M1","1.7.2-M2","1.7.3","1.7.3-M1","1.7.3-M2","1.7.4","1.7.5","1.7.5-M1","1.7.5-M2","1.7.5-M3","1.7.6","1.7.6-M2","1.7.6-M3","1.7.7","1.7.7-M1","1.7.7-M2","1.7.8","1.7.9-M1","1.7.9-M2","1.7.9-M3","1.7.9-M4","1.8.0","1.8.0-M1","1.8.0-M2","1.8.0-M3","1.8.0-M4","1.8.0-M5","1.8.0-M6","1.8.1","1.8.1-M1","1.8.1-M2","1.8.2","1.8.3","1.8.3-M1","1.8.3-M2","1.8.3-M3","1.9.0","1.9.0-M1","1.9.1","1.9.1-M1","1.9.2","1.9.2-M1","1.9.2-M10","1.9.2-M11","1.9.2-M12","1.9.2-M13","1.9.2-M14","1.9.2-M2","1.9.2-M3","1.9.2-M4","1.9.2-M5","1.9.2-M6","1.9.2-M7","1.9.2-M8","1.9.2-M9","1.9.3","1.9.3-M1","1.9.3-M2","1.9.4","1.9.4-M1","1.9.4-M2","1.9.4-M3","2.0.0","2.0.0-M1","2.0.0-RC","2.0.1-M1","2.0.1-M2","2.1.0","2.1.1","2.1.1-M1","2.1.2","2.1.3","2.1.3-M1","2.1.3-M2","2.1.3-M3","2.1.4","2.1.4-M1","2.1.4-M2","2.2.0","2.2.0-M1","2.2.0-M2","2.2.0-RC","2.2.1","2.2.10","2.2.11","2.2.11-M1","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.3","2.2.3-M1","2.2.4","2.2.4-M1","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.0-M1","2.3.0-M2","2.3.1","2.3.1-M1","2.3.1-M2","2.3.2","2.3.3-M1","2.3.3-M2","2.3.3-M3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-7q8c-49f4-4c8q/GHSA-7q8c-49f4-4c8q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}