CVE-2016-4000: Jython insecure deserialization in PyFunction object

Executive brief

Jython, a Java implementation of the Python programming language, is vulnerable to a flaw that allows remote attackers to execute malicious code. By sending specially crafted data to an application using Jython, an attacker could gain full control over the affected system. This could lead to data theft, service disruption, or unauthorized access to internal corporate resources.

Technical details

A deserialization vulnerability exists in Jython versions prior to 2.7.1b3. The root cause is the insecure handling of untrusted data when reconstructing 'PyFunction' objects from a serialized state. A remote, unauthenticated attacker can exploit this by sending a specially crafted serialized object over the network to an application that uses Jython for processing. Successful exploitation allows for arbitrary code execution (RCE) in the context of the application. The issue is addressed in version 2.7.1b3.

Affected products

• Python Software Foundation jython < 2.7.1b3
• Python Software Foundation jython-standalone < 2.7.1b3

Timeline

• 2017-07-06: advisory: NVD published the vulnerability details
• 2022-05-13: advisory: GitHub Advisory Database entry published

References

• https://api.github.com/users/theinfosecguy
• https://github.com/theinfosecguy
• https://api.github.com/users/theinfosecguy/gists%7B/gist_id%7D
• https://api.github.com/users/theinfosecguy/repos
• https://avatars.githubusercontent.com/u/33570148?v=4
• https://api.github.com/users/theinfosecguy/events%7B/privacy%7D