PT-2014-1806 · Python · S3Ql

Publicado 2014-09-02 · Atualizado 2014-09-03 · CVE-2014-0485

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions S3QL versions 1.18.1 and earlier

Description The issue allows remote attackers to execute arbitrary code via a crafted serialized object. This is due to the unsafe use of the pickle Python module in files such as common.py or local.py in backends/. Multiple vulnerabilities in the S3QL package may lead to breaches of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.

Recommendations For S3QL versions 1.18.1 and earlier, as a temporary workaround, consider restricting access to the pickle Python module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2015-04140

CVE-2014-0485

DSA-3013-1

Produtos afetados

S3Ql

Referências · 10

• 🔥 https://bitbucket.org/nikratio/s3ql/commits/091ac263809b4e8 · Exploit
• https://bdu.fstec.ru/vul/2015-04140 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0485 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2014-0485 · Aviso do Fabricante
• http://debian.org/security/2014/dsa-3013 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-0485 · Aviso do Fabricante
• http://debian.org/security/dsa-3013 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0485 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0485 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/08/28/3 · Nota