CVE-2016-4000: Critical severity jython vulnerability
Published Jun 16, 2017
·Updated
Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.
Affected Software
3 affected componentsFixes available
debian/jython
2.7.2+repack1-32.7.3+repack1-1
Jython Project Jython=2.7.0
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Jun 16, 2017
Data Sourced
07:12 AM
SeverityAffected Software
Jul 6, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4000?
CVE-2016-4000 is classified as a critical vulnerability due to its ability to allow arbitrary code execution.
2
How do I fix CVE-2016-4000?
To resolve CVE-2016-4000, update Jython to version 2.7.1rc1 or later.
3
What versions of Jython are affected by CVE-2016-4000?
CVE-2016-4000 affects Jython versions prior to 2.7.1rc1, including version 2.7.0.
4
Can CVE-2016-4000 be exploited remotely?
Yes, attackers can exploit CVE-2016-4000 remotely by leveraging a crafted serialized PyFunction object.
5
What type of vulnerability is CVE-2016-4000?
CVE-2016-4000 is a code execution vulnerability affecting the Jython interpreter.