CVE-2025-62703 Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework...

Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

Summary The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the decode function in fugue/rpc/flask.py directly uses cloudpickle.loads to deserialize data without any sanitization. This...

EUVD-2025-199591

Malicious code in rpc-validator npm...

Malicious Package

Overview rpc-validator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in rpc-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca28ab1eabeac24c0ce55063ac151338d0255fcc2c8f74909566c8c3a3a8b1f The package rpc-validator was found to contain malicious code. Source: ghsa-malware 318ca2489ffa297599695ecb6b29c76c63bb61b59d5380b1092213774438e35d...

MAL-2025-191466 Malicious code in rpc-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca28ab1eabeac24c0ce55063ac151338d0255fcc2c8f74909566c8c3a3a8b1f The package rpc-validator was found to contain malicious code. Source: ghsa-malware 318ca2489ffa297599695ecb6b29c76c63bb61b59d5380b1092213774438e35d...

fugue 代码问题漏洞

fugue is an open source unified interface for distributed computing by The Fugue Project. A code issue vulnerability exists in fugue 0.9.2 and earlier versions, which stems from FlaskRPCServer remote code execution via pickle deserialization...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2023-32731 CVE-2023-32732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2023-32731 DESCRIPTION: When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK...

TencentOS Server 3: samba (TSSA-2023:0313)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0313 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Improper Verification Of Cryptographic Signature

Apache Spark is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to the use of an unauthenticated default encryption cipher AES/CTR/NoPadding for RPC communication when spark.network.crypto.enabled is true and no cipher is explicitly configured, which allow...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-53174)

SUNRPC: The function cshow was called with protection from RCU. This only ensures that cp will not be freed. Therefore, the reference count for cp can drop to zero, which will trigger a refcount use-after-free warning when cacheget is called. This plugin only works with Tenable.ot. Please visit...

EUVD-2025-124954

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdrstreamdecodeopaqueauth, zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gsskrb5verifymicv2...

CVE-2025-40129

CVE-2025-40129 is a Linux kernel vulnerability addressed in Unity Linux/UTSA-2026-013110: sunrpc may dereference checksum.data due to a zero-length checksum in xdr_stream_decode_opaque_auth(), causing a null pointer dereference when gss_krb5_verify_mic_v2() accesses checksum.data. The patch ensur...

CVE-2025-40129

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdrstreamdecodeopaqueauth, zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gsskrb5verifymicv2...

kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails

In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfsfsprocnetinit fails. syzbot reported a warning below 1 following a fault injection in nfsfsprocnetinit. 0 When nfsfsprocnetinit fails, /proc/net/rpc/nfs is not removed. Later, rpcprocexit...

BIT-OPENTELEMETRY-COLLECTOR-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988809)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988809 advisory. In the Linux kernel, the following vulnerability has been resolved: memory: renesas-rpc-if: fix platform-device leak in error path Make sure to free the flash platfo...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990032 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988943)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988943 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of t...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988861)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988861 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svctcplistendataready After the listener svcsock is freed, and before invoking...