Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2020-22083

critique

CVE-2020-22083

python-jsonpickle: deserialization of a malicious payload in the decode function can lead to RCE

Publiée Modifiée CWE 502
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA.

Description

jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
pip::GitHub Security Advisory pipjsonpicklepas de correctif indiqué
debian 11jsonpicklepas de correctif indiqué
debian 12jsonpicklepas de correctif indiqué
debian 13jsonpicklepas de correctif indiqué
debian 14jsonpicklepas de correctif indiqué
echojsonpicklepas de correctif indiqué
rapidfort debian 12jsonpicklepas de correctif indiqué
rapidfort debian 13jsonpicklepas de correctif indiqué

Références

Les 12 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.