Lucene search

K
mageiaGentoo FoundationMGASA-2015-0122
HistoryApr 01, 2015 - 3:13 p.m.

Updated python-rope packages fix security vulnerabilities

2015-04-0115:13:37
Gentoo Foundation
advisories.mageia.org
11

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.013 Low

EPSS

Percentile

85.7%

The python-rope utility has been caught passing remotely supplied data to pickle.load(), enabling possible code-execution attacks. This can happen when the ‘perform_doa’ (dynamic object analysis) option is enabled, which it previously had been by default. This update changes the default configuration to disable this option. This only mitigates the issue, as it will still be vulnerable if the option is enabled. If ‘perform_doa’ is enabled, python-rope can be persuaded to open under some circumstances a network port for short moment of time, which can be used to push commands to the running process, so the process could run some commands under the privileges of the user running python-rope. Anyone who enables this option is advised to make sure the computer is protected by a firewall.

OSVersionArchitecturePackageVersionFilename
Mageia4noarchpython-rope< 0.9.4-4.1python-rope-0.9.4-4.1.mga4

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.013 Low

EPSS

Percentile

85.7%