Linux Distros Unpatched Vulnerability : CVE-2020-13091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the readpickle function, if reduce makes an os.system call...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

CVE-2020-13091

pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the readpickle function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the readpickle function is documented as unsafe and it is the user's responsibility to use...

CVE-2020-13091

pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the readpickle function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the readpickle function is documented as unsafe and it is the user's responsibility to use...

DEBIAN-CVE-2020-13091

pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the readpickle function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the readpickle function is documented as unsafe and it is the user's responsibility to use...

autorecsys (0.0.1), bugbug (>=0.0.132, <=0.0.137) +24 more potentially affected by CVE-2020-13091 via pandas (0.25.2)

pandas PYPI version 0.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - autorecsys 0.0.1 - bugbug =0.0.132, =0.6.7, =0.1.5, =0.2.0, =1.0.0rc1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =1.0.6, =1.13.0.dev5, =1.13.0.dev10 ...

jaqs-fxdayu (>=0.1.11, <=0.1.14), json2parquet (0.0.3) +2 more potentially affected by CVE-2020-13091 via pandas (0.20.0)

pandas PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - jaqs-fxdayu =0.1.11, =0.240517.0, =0.260430.5 - polymid 0.0.1 Source cves: CVE-2020-13091 Source advisory: OSV:PYSEC-2020-73...

pylcurves (>=0.0.2, <=0.0.2.1), pypletics (>=0.0.4.2, <=0.0.4.8) +1 more potentially affected by CVE-2020-13091 via pandas (0.20.2)

pandas PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - pylcurves =0.0.2, =0.0.4.2, =0.1.0, =0.1.2 Source cves: CVE-2020-13091 Source advisory: OSV:PYSEC-2020-73...

aioload (>=0.2.4, <=0.3.0), ard-transformer (>=0.1.0, <=0.9.3) +44 more potentially affected by CVE-2020-13091 via pandas (0.25.0)

pandas PYPI version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - aioload =0.2.4, =0.1.0, =0.3.0, =0.1.0, =0.0.70, =3.0.4, =2.0.0, =0.6.1, =0.2.3, =1.0.0, =0.3.0, =0.3.2 - dsreg 1.0.0 and more Source cves:...

cf-nlp (>=0.1.0, <=0.1.11), kitehistory (1.4.0) +3 more potentially affected by CVE-2020-13091 via pandas (0.20.1)

pandas PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - cf-nlp =0.1.0, =1.0.0, =0.1.5, =0.4.3 - pysy 0.0.6 Source cves: CVE-2020-13091 Source advisory: OSV:PYSEC-2020-73...

adaptive-boxes (>=0.0.3, <=0.0.4), adpred (>=1.1.2, <=1.2.7) +75 more potentially affected by CVE-2020-13091 via pandas (0.25.1)

pandas PYPI version 0.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - adaptive-boxes =0.0.3, =1.1.2, =0.1.2, =0.1.1, =0.1.2, =1.0.4, =1.0.0a1, =0.0.1, =0.0.94, =0.0.6, =0.0.12 and more Source cves: CVE-2020-13091 Sour...

actuapy (>=0.0.1, <=0.0.3), ada-core (>=0.1.0, <=0.3.20) +21 more potentially affected by CVE-2020-13091 via pandas (0.23.0)

pandas PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - actuapy =0.0.1, =0.1.0, =0.1.0, =1.0.6, =0.7.0, =1.0.0, =2.2.4 and more Source cves: CVE-2020-13091 Source advisory: OSV:PYSEC-2020-73...

alosi (>=0.0.3, <=1.1.2), alphapy (2.3.1) +67 more potentially affected by CVE-2020-13091 via pandas (0.22.0)

pandas PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - alosi =0.0.3, =0.0.0a0, =0.0.2, =1.2.0, =1.4.0 - d6tstack 0.1.2 - deduper 0.0.7 and more Source cves: CVE-2020-13091 Source advisory:...

ambie (0.6.3), anyrl (>=0.7.6, <=0.12.20) +39 more potentially affected by CVE-2020-13091 via pandas (0.20.3)

pandas PYPI version 0.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - ambie 0.6.3 - anyrl =0.7.6, =2.8.0, =0.0.1, =0.7.0, =0.2.5, =0.1.1, =0.1.0, =2.0.0.dev2, =0.2.0, =0.0.1, =0.0.2 and more Source cves: CVE-2020-1309...

courtana (0.7.1), deduper (>=0.0.1a0, <=0.0.3) +21 more potentially affected by CVE-2020-13091 via pandas (0.19.2)

pandas PYPI version 0.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - courtana 0.7.1 - deduper =0.0.1a0, =0.0.1, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.0.0 and more Source cves: CVE-2020-13091 Sour...

bootstrapped (0.0.1), clophfit (>=0.2.0, <=0.2.1) +10 more potentially affected by CVE-2020-13091 via pandas (0.18.1)

pandas PYPI version 0.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - bootstrapped 0.0.1 - clophfit =0.2.0, =0.4.11, =0.7.0.dev0, =0.2.0, =0.1.6, =0.0.4.dev68, =0.5.0, =0.1.5, =0.3.3, =1.1.1 - twip 0.0.6 Source cves:...

icallsv (0.0.7), styleframe (>=0.1.3.5, <=0.1.4.2) potentially affected by CVE-2020-13091 via pandas (0.16.2)

pandas PYPI version 0.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - icallsv 0.0.7 - styleframe =0.1.3.5, =0.1.4.2 Source cves: CVE-2020-13091 Source advisory: OSV:PYSEC-2020-73...

adversarial-labeller (0.1.8), aestene-lib (>=0.0.3, <=0.1.4) +468 more potentially affected by CVE-2020-13091 via pandas (0.25.3)

pandas PYPI version 0.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - adversarial-labeller 0.1.8 - aestene-lib =0.0.3, =0.1.0, =0.3.2, =0.5.1, =1.0.0, =1.5.0, =1.2.0, =1.10.0, =1.10.3b1, =1.10.10 - apache-airflow-zack...

airiam (>=0.1.2, <=0.1.6), aitoai (>=0.1.2, <=0.3.1) +252 more potentially affected by CVE-2020-13091 via pandas (>=1.0.0, <=1.0.3)

pandas PYPI version =1.0.0, =0.1.2, =0.1.2, =0.1.0, =0.0.0, =1.0.0, =0.1.10, =0.0.4, =0.0.11, =0.0.1, =0.1.0, =0.0.1, =0.0.8 and more Source cves: CVE-2020-13091 Source advisory: OSV:PYSEC-2020-73...

aequitas (>=0.26.0, <=0.33.0), bcipy (>=1.1.1, <=1.2.0) +8 more potentially affected by CVE-2020-13091 via pandas (0.21.0)

pandas PYPI version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on pandas and may be impacted: - aequitas =0.26.0, =1.1.1, =2.0.4, =0.3.0, =0.1.0, =0.5.0, =0.9.0, =0.9.3 Source cves: CVE-2020-13091 Source advisory: OSV:PYSEC-2020-73...