GHSA-5gp7-4733-2w2v
Duplicate Advisory: Picklescan Bypasses Unsafe Globals Check using pty.spawn
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-693 Protection Mechanism Failure
- Fix
- None yet
- No fixed version published
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-hgrh-qx5j-jfwx. This link is maintained to preserve external references.
Original Description
PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| picklescan | all versions |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
References
Advisories
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g38g-8gr9-h9xp PickleScan has multiple stdlib modules with direct RCE not in blocklist | Critical | Also affects picklescan |
| GHSA-vvpj-8cmc-gx39 PickleScan's pkgutil.resolve_name has a universal blocklist bypass | Critical | Also affects picklescan |
| GHSA-7wx9-6375-f5wh PickleScan's profile.run blocklist mismatch allows exec() bypass | Critical | Also affects picklescan |
| GHSA-97f8-7cmv-76j2 Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER | High | Also affects picklescan |
| GHSA-m7j5-r2p5-c39r picklescan vulnerable to arbitrary file create using logging.FileHandler | Medium | Also affects picklescan |
| GHSA-9m3x-qqw2-h32h picklescan missing detection by simple obfuscation of a `builtins.eval` call | Critical | Also affects picklescan |
| GHSA-9726-w42j-3qjr picklescan has Arbitrary file read using `io.FileIO` | High | Also affects picklescan |
| GHSA-46h3-79wf-xr6c Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter | High | Also affects picklescan |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor