ALT-PU-2021-4849-3

Обновление пакета python-module-parso в ветке sisyphus

Версия0.5.1-alt2
Задание#265625
Опубликовано2026-02-05
Макс. серьёзностьLOW
Серьёзность:

Закрытые проблемы (1)

CVE-2019-12760
LOW3.3

A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration.

Опубликовано: 2019-06-06Изменено: 2024-11-21
CVSS 2.0СРЕДНЯЯ 6.0
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H