Code injection in rope

2018-07-2616:08:49

Google

osv.dev

0.013 Low

EPSS

Percentile

85.7%

JSON

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.

CPENameOperatorVersion
ropeeq0.7.1
ropeeq0.2RC
ropeeq0.3m2
ropeeq0.10.3
ropeeq0.5
ropeeq0.7.5
ropeeq0.9.4
ropeeq0.7.3
ropeeq0.3m1
ropeeq0.3m4

Name	Operator	Version
rope	eq	0.7.1
rope	eq	0.2RC
rope	eq	0.3m2
rope	eq	0.10.3
rope	eq	0.5
rope	eq	0.7.5
rope	eq	0.9.4
rope	eq	0.7.3
rope	eq	0.3m1
rope	eq	0.3m4

Rows per page:

1-10 of 641

References

www.openwall.com/lists/oss-security/2015/02/07/1

bugzilla.redhat.com/show_bug.cgi?id=1116485

github.com/python-rope/rope

github.com/python-rope/rope/commit/b01da7aab5cd02129941d2a900e6e5e3b5f7d4fb

nvd.nist.gov/vuln/detail/CVE-2014-3539

0.013 Low

EPSS

Percentile

85.7%

JSON

Related for OSV:GHSA-R38R-QP28-2M63