CVE-2020-20136 - QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library

Back Back to CVE browser

CRITICAL

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library

Published Dec 14, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.54%

Description

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (3)

https://github.com/QuantConnect/Lean/issues/3537
x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-ww7r-278h-48mh
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-20136

Link	Providers	Tags
https://github.com/QuantConnect/Lean/issues/3537		x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-ww7r-278h-48mh		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-20136