Описание
pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needs-triage |
| devel | not-affected | disputed |
| eoan | ignored | end of life |
| esm-apps/bionic | not-affected | disputed |
| esm-apps/focal | not-affected | disputed |
| esm-apps/jammy | not-affected | disputed |
| esm-apps/noble | not-affected | disputed |
| esm-apps/xenial | not-affected | disputed |
| esm-infra-legacy/trusty | not-affected | disputed |
| focal | not-affected | disputed |
Показывать по
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
pandas through 1.0.3 can unserialize and execute commands from an untr ...
pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call.
7.5 High
CVSS2
9.8 Critical
CVSS3