PT-2025-10574 · Unknown+1 · Picklescan+1

Madgetr · Publicado 2025-03-10 · Atualizado 2025-03-19 · CVE-2025-1944

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions PickleScan versions prior to 0.0.23

Description The issue allows for a ZIP archive manipulation attack, causing PickleScan to crash when extracting and scanning PyTorch model archives. An attacker can modify the filename in the ZIP header, while keeping the original filename in the directory listing, to make PickleScan raise a BadZipFile error. However, PyTorch's ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.

Recommendations For versions prior to 0.0.23, update to version 0.0.23 or later to resolve the issue. As a temporary workaround, consider restricting the use of PickleScan to scan PyTorch model archives until a patch is available. Avoid using PickleScan to extract and scan ZIP archives that may contain malicious payloads.

Exploit

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2025-1944

GHSA-7Q5R-7GVP-WC82

GHSA-W6MR-MJ53-X258

PYSEC-2025-20

Produtos afetados

Picklescan

Pytorch

Referências · 18

• 🔥 https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1944 · Exploit
• https://github.com/mmaitre314/picklescan · Nota
• https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781 · Correção
• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82 · Aviso do Fabricante
• https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2025-20.yaml · Nota
• https://osv.dev/vulnerability/CVE-2025-1944 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7q5r-7gvp-wc82 · Aviso do Fabricante
• https://sonatype.com/security-advisories/cve-2025-1944 · Nota
• https://twitter.com/centry_agent/status/1899074525100384538 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-1944 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2025-20 · Aviso do Fabricante
• https://t.me/cvedetector/19952 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1899062039848624410 · Publicação no Twitter
• https://t.me/cvenotify/114043 · Publicação no Telegram
• https://twitter.com/dailycve/status/1902411435914792984 · Publicação no Twitter