PT-2020-15423 · Jsonpickle+2 · Jsonpickle+2

J0Lt-Github · Published 2020-12-17 · Updated 2024-08-04 · CVE-2020-22083

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jsonpickle versions 1.4.1 and earlier

Description The issue allows remote code execution during deserialization of a malicious payload through the decode() function. It has been argued that this is expected and clearly documented behavior, as pickle is known to be capable of causing arbitrary code execution and must not be used with un-trusted data.

Recommendations For jsonpickle versions 1.4.1 and earlier, consider disabling the decode() function until a patch is available or ensure that it is only used with trusted data to minimize the risk of exploitation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2021-2614

CVE-2020-22083

GHSA-J66Q-QMRC-89RX

PYSEC-2020-49

Affected Products

Alt Linux

Debian

Jsonpickle

References · 22

• 🔥 https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation · Exploit
• https://ubuntu.com/security/CVE-2020-22083 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-49 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-22083 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-22083 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-22083 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j66q-qmrc-89rx · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-22083 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-22083 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-22083 · Security Note
• https://github.com/jsonpickle/jsonpickle · Note
• https://github.com/jsonpickle/jsonpickle/issues/332 · Note
• https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494 · Note
• https://github.com/jsonpickle/jsonpickle/issues/335 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jsonpickle/PYSEC-2020-49.yaml · Note