GitHub Advisoryadvisory · PyPI

GHSA-vrcf-g539-x6h3 Uncontrolled deserialization of a pickled object in rediswrapper allows attackers to execute arbitrary scripts

CRITICAL Published 2019-11-20 Modified 2024-10-26 Official page ↗
Aliases
CVE-2019-17206
Ecosystem
PyPI
Packages
rediswrapper
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2019-11-19

Affected packages

• PyPI rediswrapper: < 0.3.0 → fixed in 0.3.0

Description

Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts.

Related

Alias · CVE (1)

  • CVE-2019-17206 Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References