PT-2019-12928 · Parso+1 · Parso+1

Dhondtao · Published 2019-06-06 · Updated 2024-08-05 · CVE-2019-12760

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parso versions through 0.4.0

Description A deserialization vulnerability exists in the way parso handles grammar parsing from the cache. Cache loading relies on pickle, and if an evil pickle can be written to a cache grammar file and its parsing can be triggered, this flaw leads to Arbitrary Code Execution. This issue is disputed because the cache directory is not under the control of the attacker in any common configuration.

Recommendations For parso versions through 0.4.0, consider disabling the cache loading feature that relies on pickle until a patch is available. Restrict access to the cache directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2021-4849

CVE-2019-12760

GHSA-22MF-97VH-X8RW

PYSEC-2019-109

Affected Products

Alt Linux

Parso

References · 15

• 🔥 https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12760 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12760 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12760 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-12760 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12760 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-22mf-97vh-x8rw · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-12760 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-109 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12760 · Vendor Advisory
• https://github.com/davidhalter/parso/issues/75 · Note
• https://github.com/davidhalter/parso · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/parso/PYSEC-2019-109.yaml · Note
• https://t.me/cvenotify/89081 · Telegram Post
• https://github.com/advisories/GHSA-22mf-97vh-x8rw · Note