Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.9epss 0.5%
probabilidade de exploração
0.5%top 57% das CVEs
exploração observada
nãonenhuma fonte reporta
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks. This issue has been patched in version 0.1.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
trailofbits · ficklingReferências
https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9https://github.com/trailofbits/fickling/releases/tag/v0.1.7https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x