description: Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
problem types: Deserialization of Untrusted Data (CWE-502)
affected:
{
product: Buck
vendor: Facebook
versions:
status: affected, version: v2018.06.25.01
lessThanOrEqual: v2018.06.25.01, status: affected, version: unspecified, versionType: custom
}