GHSA-5M22-CFQ9-86X6 Pickle serialization vulnerable to Deserialization of Untrusted Data

🗓️ 13 Oct 2023 19:25:39Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Pickle default serialization insecure; switch to JSON to avoid deserialization risk in vantage6.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2023-23930	11 Oct 202322:17	–	circl
CNNVD	vantage6 Code Issue Vulnerability	11 Oct 202300:00	–	cnnvd
CVE	CVE-2023-23930	11 Oct 202317:39	–	cve
Cvelist	CVE-2023-23930 vantage6's Pickle serialization is insecure	11 Oct 202317:39	–	cvelist
EUVD	EUVD-2023-0257	3 Oct 202520:07	–	euvd
Github Security Blog	Pickle serialization vulnerable to Deserialization of Untrusted Data	13 Oct 202319:25	–	github
NVD	CVE-2023-23930	11 Oct 202318:15	–	nvd
OSV	CVE-2023-23930 vantage6's Pickle serialization is insecure	11 Oct 202317:39	–	osv
OSV	PYSEC-2023-196	11 Oct 202318:15	–	osv
Prion	Default configuration	11 Oct 202318:15	–	prion

Source	Link
github	www.github.com/vantage6/vantage6/security/advisories/GHSA-5m22-cfq9-86x6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-23930
github	www.github.com/vantage6/vantage6/commit/e62f03bacf2247bd59eed217e2e7338c3a01a5f0
github	www.github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-196.yaml
github	www.github.com/vantage6/vantage6
github	www.github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst
medium	www.medium.com/ochrona/python-pickle-is-notoriously-insecure-d6651f1974c9

18 Nov 2024 23:24Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.2

CVSS 48.6

EPSS0.00892