Critical severityNVD Advisory· Published Jul 8, 2022· Updated Aug 3, 2024
CVE-2022-35411
CVE-2022-35411
Description
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
rpc.pyPyPI | >= 0.4.2, <= 0.6.0 | — |
Affected products
2- rpc.py/rpc.pydescription
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-8rq8-f485-7v8xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-35411ghsaADVISORY
- packetstormsecurity.com/files/167872/rpc.py-0.6.0-Remote-Code-Execution.htmlghsax_refsource_MISCWEB
- github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bdghsax_refsource_MISCWEB
- github.com/abersheeran/rpc.py/issues/22ghsaWEB
- medium.com/%40elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30ghsax_refsource_MISCWEB
- medium.com/@elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30ghsaWEB
News mentions
0No linked articles in our index yet.