[TINKERPOP-2032] Update jython-standalone

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.3, 3.2.9
• Fix Version/s: 3.4.0, 3.3.4, 3.2.10
• Component/s: python
• Assignee: Robert Dale
• Reporter: Robert Dale
• Created: 11/Sep/18 12:34
• Updated: 19/Sep/18 12:48
• Resolved: 19/Sep/18 12:48

Description

https://snyk.io/vuln/SNYK-JAVA-ORGPYTHON-31451

Overview
org.python:jython-standalone Affected versions of this package are vulnerable to Arbitrary Code Execution by sending a serialized function to the deserializer, which in turn will execute the code.

References
[ CVE|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4000]
Jython Bug Report
[ Fix Commit|https://hg.python.org/jython/rev/d06e29d100c0]

Issue Links

• links to: GitHub Pull Request #930