CVE-2017-15288: Privilege Escalation in org.scala-lang:scala-compiler
Summary
CVE-2017-15288: High severity vulnerability that affects org.scala-lang:scala-compiler. Affects org.scala-lang:scala-compiler across 3 version ranges.
< 2.10.7
>= 2.11.0, < 2.11.12
>= 2.12.0, < 2.12.4
Fixed in 2.10.7, 2.11.12 or 2.12.4, depending on the release line you run. How to fix ↓
Also tracked for
- scala · Debian:11
The same CVE-2017-15288 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.scala-lang:scala-compiler is a package in the Maven ecosystem that provides the Scala compiler. Scala is a programming language that runs on the Java Virtual Machine (JVM) and is widely used for building scalable and high-performance applications. The scala-compiler package is responsible for compiling Scala source code into bytecode that can be executed on the JVM. This vulnerability affects versions of Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4.
Vulnerability Detail
The vulnerability in org.scala-lang:scala-compiler is classified as high severity with a CVSS score of 7.8. It stems from the weak permissions set for private files in the compilation daemon's temporary directory. Specifically, the directory /tmp/scala-devel/${USER:shared}/scalac-compile-server-port has weak permissions, allowing local users to write to arbitrary class files. This can lead to privilege escalation, enabling an attacker to gain unauthorized access and execute arbitrary code with elevated privileges. The impact of this vulnerability is significant as it compromises the integrity and confidentiality of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.10.72.10.7 -
>= 2.11.0, < 2.11.122.11.12 -
>= 2.12.0, < 2.12.42.12.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the org.scala-lang:scala-compiler package to the fixed versions mentioned above.
Conclusion
The vulnerability in org.scala-lang:scala-compiler poses a significant risk to the security and integrity of systems using Scala. It is crucial to update the package to the fixed versions (2.10.7, 2.11.12, or 2.12.4) to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.scala-lang:scala-compiler →
FAQ
org.scala-lang:scala-compiler is a package in the Maven ecosystem that provides the Scala compiler. It is used to compile Scala source code into bytecode that can be executed on the JVM.
Versions of org.scala-lang:scala-compiler before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 are affected by this vulnerability.
This vulnerability allows local users to write to arbitrary class files, leading to privilege escalation. An attacker could gain unauthorized access and execute arbitrary code with elevated privileges.
To fix this vulnerability, update the org.scala-lang:scala-compiler package to version 2.10.7, 2.11.12, or 2.12.4, depending on the version currently in use.
No, there is no known workaround for this vulnerability. It is essential to update the org.scala-lang:scala-compiler package to the fixed versions.
