What is GHSA-ww7r-278h-48mh?

GHSA-ww7r-278h-48mh is a security advisory published by GitHub Security Advisories with Critical severity. QuantConnect Lean vulnerable to insecure deserialization

Which CVE IDs does GHSA-ww7r-278h-48mh cover?

GHSA-ww7r-278h-48mh covers the following CVE IDs: CVE-2020-20136. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ww7r-278h-48mh?

GHSA-ww7r-278h-48mh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-ww7r-278h-48mh?

GHSA-ww7r-278h-48mh affects 1 product, including: nuget/QuantConnect.Common:\u003e= 2.3.0.0, \u003c= 2.4.0.1.

GHSA-ww7r-278h-48mhCriticalCVSS 9.8

QuantConnect Lean vulnerable to insecure deserialization

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

July 20, 2023

🔗 CVE IDs covered (1)

CVE-2020-20136 →

📋 Description

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library. One may avoid this issue by only running Lean in an environment where data provided is trusted.

🎯 Affected products1

nuget/QuantConnect.Common:>= 2.3.0.0, <= 2.4.0.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-20136
https://github.com/QuantConnect/Lean/issues/3537
https://github.com/advisories/GHSA-ww7r-278h-48mh