Lucene search

Veracode Vulnerability DatabaseVERACODE:47104

HistoryMay 22, 2024 - 6:12 a.m.

Deserialization Of Untrusted Data

2024-05-2206:12:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

joblib

untrusted data

deserialization

vulnerability

pickle files

numpy_pickle.py

arbitrary code

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

joblib is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe handling of pickle files in the read_array() function within numpy_pickle.py where pickle.load is enabled by default. This allows an attacker to execute arbitrary code by loading a maliciously crafted pickle file.

CPENameOperatorVersion
joblible1.4.2
joblible1.4.2

CPE	Name	Operator	Version
	joblib	le	1.4.2
	joblib	le	1.4.2

References

github.com/danigm/joblib/commit/4177f3b9ca46475fd0d4cad6fd284acba189af45

github.com/joblib/joblib/issues/1582

github.com/joblib/joblib/issues/977

github.com/joblib/joblib/pull/1585