GitHub Advisoryadvisory · PyPI

GHSA-vxp9-wv2f-wqmw Deserialization of Untrusted Data in superset

CRITICAL Published 2018-11-09 Modified 2024-10-28 Official page ↗
Aliases
CVE-2018-8021
Ecosystem
PyPI
Packages
superset
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2020-06-16

Affected packages

• PyPI superset: < 0.23 → fixed in 0.23

Description

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

Related

Alias · CVE (1)

  • CVE-2018-8021 Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References