Description
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Remediation
References
https://www.scala-lang.org/download/
https://github.com/scala/scala/pull/10118
https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2
https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/
Related Vulnerabilities
CVE-2019-1352 Vulnerability in npm package nodegit
CVE-2020-1698 Vulnerability in maven package org.keycloak:keycloak-authz-client
CVE-2022-24433 Vulnerability in npm package simple-git
CVE-2021-30181 Vulnerability in maven package org.apache.dubbo:dubbo
CVE-2022-28366 Vulnerability in maven package net.sourceforge.htmlunit:neko-htmlunit