CVE-2018-6331
Critical
Description
Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
SeverityCritical
CVSS9.8
Exploit probability—
ProductFacebook Buck
PublishedDec 31, 2018
First seenDec 31, 2018
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- facebook buck2018.06.25.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| facebook buck | v < 2018.06.25.01 | 2018.06.25.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.