PT-2025-45693 · Pypi · Cryptidy

Publicado 2025-10-31 · Atualizado 2025-10-31

OSV

CVSS v3.1

6.9

Média

Vetor base

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes decrypt message in symmetric encryption.py.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

GHSA-97W9-V595-3H5Q

Produtos afetados

Cryptidy

Referências · 5

• https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238 · Nota
• https://github.com/netinvent/cryptidy · Nota
• https://osv.dev/vulnerability/GHSA-97w9-v595-3h5q · Aviso do Fabricante
• https://github.com/javiermorales36/cryptidy-analysis · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-63675 · Nota de Segurança