critical9.8
CVE-2021-31819
Remote Code Execution in Halibut
Impact
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Halibut | < 4.4.7 | 4.4.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octopus | Halibut | before 4.4.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29.2250309681.html
- https://github.com/advisories/GHSA-hpf7-4c2g-9chf
- https://nvd.nist.gov/vuln/detail/CVE-2021-31819
- https://advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-(CVE-2021-31819).2250309681.html