PT-2019-14629 · Rpyc+1 · Rpyc+1

Publicado 2019-10-03 · Atualizado 2024-07-12 · CVE-2019-16328

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RPyC versions 4.1.x through 4.1.1

Description A remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

Recommendations For RPyC versions 4.1.x through 4.1.1, consider disabling remote procedure calls until a patch is available. Restrict access to the RPyC service to minimize the risk of exploitation. Avoid using default configuration settings for the RPyC service until the issue is resolved.

Exploit

Correção

Prototype Pollution

Improper Authorization

Enumeração de Fraquezas

CWE-1321

CWE-285

Identificadores relacionados

CVE-2019-16328

GHSA-9GGP-4JPR-7PPJ

GHSA-PJ4G-4488-WMXM

OPENSUSE-SU-2020:0685-1

OPENSUSE-SU-2020:0763-1

OPENSUSE-SU-2020_0685-1

OPENSUSE-SU-2024:11268-1

OPENSUSE-SU-2024:14162-1

PYSEC-2019-118

Produtos afetados

Rpyc

Suse

Referências · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/rpyc_rce.py · Exploit
• 🔥 https://rpyc.readthedocs.io/en/latest/docs/security.html · Exploit
• https://github.com/tomerfiliba/rpyc · Nota
• https://github.com/tomerfiliba-org/rpyc/security/advisories/GHSA-pj4g-4488-wmxm · Nota
• https://github.com/tomerfiliba-org/rpyc · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/rpyc/PYSEC-2019-118.yaml · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2020:0763-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:14162-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-16328 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00046.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9ggp-4jpr-7ppj · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-118 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pj4g-4488-wmxm · Aviso do Fabricante
• https://bugzilla.suse.com/1152987 · Nota
• https://github.com/advisories/GHSA-9ggp-4jpr-7ppj · Nota