Bug 1908869 (CVE-2020-22083) - CVE-2020-22083 python-jsonpickle: deserialization of a malicious payload in the decode function can lead to RCE
Summary: CVE-2020-22083 python-jsonpickle: deserialization of a malicious payload in t...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-22083
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1908870 1908871
Blocks: 1908873
TreeView+ depends on / blocked
 
Reported: 2020-12-17 18:45 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-06-07 14:16 UTC (History)
13 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-12-18 07:31:08 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-12-17 18:45:13 UTC 
jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function.

References:
https://github.com/jsonpickle/jsonpickle/issues/332
https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874
Comment 1 Guilherme de Almeida Suckevicz 2020-12-17 18:45:37 UTC 
Created python-jsonpickle tracking bugs for this issue:

Affects: epel-all [bug 1908871]
Affects: fedora-all [bug 1908870]
Comment 2 Doran Moppert 2020-12-18 01:27:38 UTC 
Statement:

Both jsonpickle and pickle are documented as being able to execute arbitrary code when loading pickles, and intended for use only with trusted data. This is expected behaviour, as clearly indicated in the jsonpickle README and at https://docs.python.org/3/library/pickle.html
Comment 3 Product Security DevOps Team 2020-12-18 07:31:08 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-22083
Note You need to log in before you can comment on or make changes to this bug.