Lucene search
GoogleOSV:GHSA-WW7R-278H-48MHHistoryMay 24, 2022 - 5:36 p.m.
QuantConnect Lean vulnerable to insecure deserialization
2022-05-2417:36:17
Google
osv.dev
5
0.008 Low
EPSS
Percentile
81.7%
QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library. One may avoid this issue by only running Lean in an environment where data provided is trusted.
| CPE | Name | Operator | Version |
|---|---|---|---|
| quantconnect.common | eq | 2.4.0.1-unofficial |
Related
osv
osv
CVE-2020-20136
2020-12-14 19:15:12
github
github
QuantConnect Lean vulnerable to insecure deserialization
2022-05-24 17:36:17
cve
cve
CVE-2020-20136
2020-12-14 19:15:12
cvelist
cvelist
CVE-2020-20136
2020-12-14 18:30:43
prion
prion
Deserialization of untrusted data
2020-12-14 19:15:00
nvd
nvd
CVE-2020-20136
2020-12-14 19:15:12