Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An issue in Open Source: RPyC v.4.00 thru v.5.3.1 allows a remote attacker to execute arbitrary code via a crafted script to the array attribute component. This vulnerability was introduced in 9f45f826. Attack Vector RPyC services that rely on the array attribute used by numpy are impacted. When the server-side exposes a method that calls the attribute named array for a a client provided netref (e.g., np.array(clientnetref)), a remote attacker can craft a class which results in remote code execution Impact Assuming the system exposes a method that calls the attribute array, an attacker can execute code using the vulnerable component. Patches The fix is available in RPyC 6.0.0. The major version change is because some users may need to set allowpickle to True when migrating to RPyC 6. Workarounds While the recommend fix is to upgrade to RPyC 6.0.0, the workaround is to apply bba1d356 as patch. Affected Component The affected component is the array method constructed for NetrefClass.…
Recommended action: Upgrade to 6.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Version 4.1.0 of RPyC has a vulnerability that affects custom RPyC services making it susceptible to authenticated remote attacks. Patches Git commits between September 2018 and October 2019 and version 4.1.0 are vulnerable. Use a version of RPyC that is not affected. Workarounds The commit `d818ecc83a92548994db75a0e9c419c7bce680d6` could be used as a patch to add the missing access check. References CVE-2019-16328 RPyC Security Documentation For more information If you have any questions or comments about this advisory: * Open an issue using GitHub Proof of Concept ``` import logging import rpyc import tempfile from subprocess import Popen, PIPE import unittest PORT = 18861 SERVER_SCRIPT = f"""#!/usr/bin/env python import rpyc from rpyc.utils.server import ThreadedServer,…
Recommended action: Upgrade to 4.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.