CVE-2018-15890

2019-06-2017:15:09

Google

osv.dev

7.2 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.9%

JSON

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.

CPENameOperatorVersion
ethereumjeq1.7.2
ethereumjeq1.7.0
ethereumjeq1.2.0-homestead-RC
ethereumjeq1.3.0-RC2-daoRescue
ethereumjeq1.8.0
ethereumjeq1.6.3
ethereumjeq1.3.1
ethereumjeq1.4.1
ethereumjeq1.3.7
ethereumjeq1.3.9

Name	Operator	Version
ethereumj	eq	1.7.2
ethereumj	eq	1.7.0
ethereumj	eq	1.2.0-homestead-RC
ethereumj	eq	1.3.0-RC2-daoRescue
ethereumj	eq	1.8.0
ethereumj	eq	1.6.3
ethereumj	eq	1.3.1
ethereumj	eq	1.4.1
ethereumj	eq	1.3.7
ethereumj	eq	1.3.9