All errata/sisyphus/ALT-PU-2021-4849-3
ALT-PU-2021-4849-3

Package update python-module-parso in branch sisyphus

Version0.5.1-alt2
Published2026-02-05
Max severityLOW
Severity:

Closed issues (1)

CVE-2019-12760
LOW3.3

A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration.

Published: 2019-06-06Modified: 2024-11-21
CVSS 2.0MEDIUM 6.0
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H