CVE-2018-6331: Critical severity Facebook Buck vulnerability
Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Buckto a version that resolves this vulnerability.Fixed in v2018.06.25.01
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6331?
CVE-2018-6331 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2018-6331?
To fix CVE-2018-6331, upgrade Buck to version 2018.06.25.01 or later.
What software is affected by CVE-2018-6331?
CVE-2018-6331 affects all versions of Buck prior to 2018.06.25.01.
What is the exploit mechanism for CVE-2018-6331?
CVE-2018-6331 can be exploited by crafting malicious serialized objects that, when deserialized, lead to arbitrary code execution.
Who is the vendor responsible for CVE-2018-6331?
The vendor responsible for CVE-2018-6331 is Facebook, the creator of the Buck build system.