PT-2019-14629 · Rpyc+1 · Rpyc+1

Published 2019-10-03 · Updated 2024-07-12 · CVE-2019-16328

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RPyC versions 4.1.x through 4.1.1

Description A remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

Recommendations For RPyC versions 4.1.x through 4.1.1, consider disabling remote procedure calls until a patch is available. Restrict access to the RPyC service to minimize the risk of exploitation. Avoid using default configuration settings for the RPyC service until the issue is resolved.

Exploit

Fix

Prototype Pollution

Improper Authorization

Weakness Enumeration

CWE-1321

CWE-285

Related Identifiers

CVE-2019-16328

GHSA-9GGP-4JPR-7PPJ

GHSA-PJ4G-4488-WMXM

OPENSUSE-SU-2020:0685-1

OPENSUSE-SU-2020:0763-1

OPENSUSE-SU-2020_0685-1

OPENSUSE-SU-2024:11268-1

OPENSUSE-SU-2024:14162-1

PYSEC-2019-118

Affected Products

Rpyc

Suse

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/rpyc_rce.py · Exploit
• 🔥 https://rpyc.readthedocs.io/en/latest/docs/security.html · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2020:0763-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14162-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-16328 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00046.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9ggp-4jpr-7ppj · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-118 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pj4g-4488-wmxm · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0685-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16328 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-16328 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16328 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-16328 · Vendor Advisory