PatchTheCVEjython vulnerabilities and fixes
Recent CVEs affecting jython, with upgrade or downgrade steps. 2 tracked.
jython has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2017-07-06. Highest priority: CVE-2016-4000 (score 68/100).
- CVE-2016-4000 CRITICAL 9.8 DOWNGRADE MITIGATE Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.
- CVE-2013-2027 MEDIUM 4.6 MITIGATE DOWNGRADE Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users t
FAQ
How do I fix jython vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is jython being exploited right now?
None of the tracked jython CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which jython CVE should I patch first?
CVE-2016-4000 currently ranks highest (68/100): Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object..