Remote Code Execution in Halibut

严重 9.8CVE-2021-31819 · GHSA-hpf7-4c2g-9chf · Published 22/09/2021 · updated 17/06/2026

要点

CVE-2021-31819 是影响 Halibut, halibut (octopus) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：2.4%，高于 83.7% 的漏洞。
修复：升级到 4.4.7 或更高版本。

Package	Affected versions	Patched versions
Halibut NuGet	`< 4.4.7`	`4.4.7`
halibut octopus	`< 4.4.7`	`4.4.7`

Description

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.

NVD description

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.

References

nvd.nist.gov/vuln/detail/CVE-2021-31819 · ADVISORY
advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-(CVE-2021-31819).2250309681.html · WEB
OctopusDeploy/Halibut · PACKAGE
advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29.2250309681.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free