-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ome:pom-bio-formats | maven | <= 8.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a straightforward case of unsafe Java deserialization. The loci.formats.Memoizer class, intended to cache image metadata, reads and deserializes .bfmemo files without any validation. The vulnerability is triggered when an image is processed, and a corresponding malicious .bfmemo file is present. The constructor of the Memoizer class is the entry point for this vulnerability, as it's responsible for loading and deserializing the memoization file. The provided advisories and the proof-of-concept stack trace clearly point to loci.formats.Memoizer.<init> as the vulnerable function. Since no patch has been released, the vulnerable code, which uses java.io.ObjectInputStream in an unsafe manner, persists in the codebase.
loci.formats.Memoizer.Memoizercomponents/formats-bsd/src/loci/formats/Memoizer.java