PT-2014-1806 · Python · S3Ql

Published 2014-09-02 · Updated 2014-09-03 · CVE-2014-0485

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions S3QL versions 1.18.1 and earlier

Description The issue allows remote attackers to execute arbitrary code via a crafted serialized object. This is due to the unsafe use of the pickle Python module in files such as common.py or local.py in backends/. Multiple vulnerabilities in the S3QL package may lead to breaches of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.

Recommendations For S3QL versions 1.18.1 and earlier, as a temporary workaround, consider restricting access to the pickle Python module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2015-04140

CVE-2014-0485

DSA-3013-1

Affected Products

S3Ql

References · 10

• 🔥 https://bitbucket.org/nikratio/s3ql/commits/091ac263809b4e8 · Exploit
• https://bdu.fstec.ru/vul/2015-04140 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0485 · Security Note
• https://osv.dev/vulnerability/CVE-2014-0485 · Vendor Advisory
• http://debian.org/security/2014/dsa-3013 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0485 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0485 · Security Note
• http://debian.org/security/dsa-3013 · Note
• http://openwall.com/lists/oss-security/2014/08/28/3 · Note