CVE-2014-0485 S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.
HighCVSS 7.5
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/s3ql(Debian:13) | < 2.10.1+dfsg-4 | 2.10.1+dfsg-4 |
| debian/s3ql(Debian:14) | < 2.10.1+dfsg-4 | 2.10.1+dfsg-4 |
| s3ql project s3ql | <= 1.18.1 | No fix listed |
| s3ql project s3ql | = 1.17 | No fix listed |
| s3ql project s3ql | = 1.18 | No fix listed |
References
- Debian Security Tracker CVE-2014-0485 vendor-advisory
- DSA-3013 vendor-advisory
- [oss-security] 20140828 CVE-2014-0485: unsafe Python pickle in s3ql mailing-list
- bitbucket.org exploit patch