[MSHARED-961] Upgrade BeanShell to 2.0b6

• Type: Dependency upgrade
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: maven-script-interpreter-1.3
• Component/s: maven-script-interpreter
• Assignee: Sylwester Lachiewicz
• Reporter: Sylwester Lachiewicz
• Created: 10/Oct/20 12:07
• Updated: 18/Oct/20 10:43
• Resolved: 10/Oct/20 12:20

Description

Update to latest available Beanshel version 2.0b6

https://github.com/beanshell/beanshell/releases/tag/2.0b6

BeanShell 2.0b6 is a security update that is functionally equivalent to the previous version 2.0b5.

No other functionality has changed since 2.0b5, but this is a recommended update for all BeanShell users, as it fixes a remote code execution vulnerability.

Security fix (CVE-2016-2510)

This release fixes a remote code execution vulnerability that was identified in BeanShell by Alvaro Muñoz and Christian Schneider. The BeanShell team would like to thank them for their help and contributions to this fix!

An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source.

A vulnerable application could be exploited for remote code execution, including executing arbitrary shell commands.

This update fixes the vulnerability in BeanShell, but it is worth noting that applications doing such deserialization might still be insecure through other libraries. It is recommended that application developers take further measures such as using a restricted class loader when deserializing. See notes on Java serialization security, XStream security and How to secure deserialization from untrusted input without using encryption or sealing.

A MITRE CVE number has been reserved: CVE-2016-2510

Issue Links

• links to: GitHub Pull Request #28