CVE-2024-27758

In RPyC before 6.0.0, when a server exposes a method that calls the attribute named array for a client-provided netref e.g., np.arrayclientnetref, a remote attacker can craft a class that results in remote code execution...

Arbitrary Code Execution

RPyC is vulnerable to arbitrary code execution. The vulnerability is due to a flaw in the handling of the array attribute specifically when the server-side exposes a method that calls the attribute array for a client provided netref e.g., np.arrayclientnetref. A remote attacker can exploit this b...

aedttest (=0.0.2), ansys-magnet-segmentation-toolkit (>=0.3.2 <=0.3.3) +51 more potentially affected by CVE-2024-27758 via rpyc (>=4.0.1 <=5.3.1)

rpyc PYPI version =4.0.1, =0.3.2, =3.0.0, =0.0.25, =0.2.0, =1.0.0, =1.0.0, =1.4.1, =1.0.0, =1.0.0, =0.0.0, =2.17.18, =3.11.20 - fuzzydata =0.0.2 and more Source cves: CVE-2024-27758 Source advisory: OSV:GHSA-H5CG-53G7-GQJW...

GHSA-H5CG-53G7-GQJW RPyC's missing security check results in code execution when using numpy.array on the server-side.

An issue in Open Source: RPyC v.4.00 thru v.5.3.1 allows a remote attacker to execute arbitrary code via a crafted script to the array attribute component. This vulnerability was introduced in 9f45f826. Attack Vector RPyC services that rely on the array attribute used by numpy are impacted. When...

RPyC's missing security check results in code execution when using numpy.array on the server-side.

An issue in Open Source: RPyC v.4.00 thru v.5.3.1 allows a remote attacker to execute arbitrary code via a crafted script to the array attribute component. This vulnerability was introduced in 9f45f826. Attack Vector RPyC services that rely on the array attribute used by numpy are impacted. When...

Metasploit Weekly Wrap-Up

Metasploit T-Shirt Design Contest In honor of Metasploit's 20th anniversary, Rapid7 is launching special edition t-shirts - and we're inviting members of our community to have a hand in its creation. The contest winner will have their design featured on the shirts, which will then be available to...

RPyC 4.1.0 through 4.1.1 Remote Command Execution

This module allows remote command execution on RPyC versions 4.1.0 and 4.1.1. You will be able to execute a specified command on the target machine as the user running the RPyC service and view the output. Module Options msf use auxiliary/scanner/http/rpycrce msf auxiliaryrpycrce show actions...

xtlib (>=0.0.176 <=0.0.996) potentially affected by CVE-2019-16328 via rpyc (=4.1.0)

rpyc PYPI version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on rpyc and may be impacted: - xtlib =0.0.176, =0.0.996 Source cves: CVE-2019-16328 Source advisory: OSV:GHSA-PJ4G-4488-WMXM...

Dynamic modification of RPyC service due to missing security check

Impact Version 4.1.0 of RPyC has a vulnerability that affects custom RPyC services making it susceptible to authenticated remote attacks. Patches Git commits between September 2018 and October 2019 and version 4.1.0 are vulnerable. Use a version of RPyC that is not affected. Workarounds The commi...

OPENSUSE-SU-2020:0763-1 Security update for python-rpyc

This update for python-rpyc to 4.1.5 fixes the following issues: Security issue fixed: - CVE-2019-16328: Fixed a missing protocol security check that could have led to code execution boo1152987. This update was imported from the openSUSE:Leap:15.1:Update update project...

Security update for python-rpyc (moderate)

openSUSE Security Update: Security update for python-rpyc Announcement ID: openSUSE-SU-2020:0763-1 Rating: moderate References: 1152987 Cross-References: CVE-2019-16328 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This upda...

openSUSE Security Update : python-rpyc (openSUSE-2020-685)

This update for python-rpyc to 4.1.5 fixes the following issues : Security issue fixed : - CVE-2019-16328: Fixed a missing protocol security check that could have led to code execution boo1152987. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

OPENSUSE-SU-2020:0685-1 Security update for python-rpyc

This update for python-rpyc to 4.1.5 fixes the following issues: Security issue fixed: - CVE-2019-16328: Fixed a missing protocol security check that could have led to code execution boo1152987...

Security update for python-rpyc (moderate)

openSUSE Security Update: Security update for python-rpyc Announcement ID: openSUSE-SU-2020:0685-1 Rating: moderate References: 1152987 Cross-References: CVE-2019-16328 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

Remote Code Execution

rpyc is vulnerable to remote code execution. A remote attacker is able to construct a remote procedure call and execute arbitrary code in the RPyC service by modifying object attributes. The vulnerability exists in the default configuration settings of the RPyC service...

GHSA-9GGP-4JPR-7PPJ Duplicate Advisory: Possible remote code execution via a remote procedure call

Withdrawn: duplicate of GHSA-pj4g-4488-wmxm Original Description In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...

Duplicate Advisory: Possible remote code execution via a remote procedure call

Withdrawn: duplicate of GHSA-pj4g-4488-wmxm Original Description In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...

CVE-2019-16328

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...

CVE-2019-16328

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...

Default configuration

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...