Bug 1908869 (CVE-2020-22083) - CVE-2020-22083 python-jsonpickle: deserialization of a malicious payload in the decode function can lead to RCE
Summary: CVE-2020-22083 python-jsonpickle: deserialization of a malicious payload in t...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-22083
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1908871 1908870
Blocks: 1908873
TreeView+ depends on / blocked
 
Reported: 2020-12-17 18:45 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-06-07 14:16 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Python-jsonpickle allows remote code execution during deserialization of a malicious payload through the decode() function.
Clone Of:
Environment:
Last Closed: 2020-12-18 07:31:08 UTC


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-12-17 18:45:13 UTC
jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function.

References:
https://github.com/jsonpickle/jsonpickle/issues/332
https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874

Comment 1 Guilherme de Almeida Suckevicz 2020-12-17 18:45:37 UTC
Created python-jsonpickle tracking bugs for this issue:

Affects: epel-all [bug 1908871]
Affects: fedora-all [bug 1908870]

Comment 2 Doran Moppert 2020-12-18 01:27:38 UTC
Statement:

Both jsonpickle and pickle are documented as being able to execute arbitrary code when loading pickles, and intended for use only with trusted data. This is expected behaviour, as clearly indicated in the jsonpickle README and at https://docs.python.org/3/library/pickle.html

Comment 3 Product Security DevOps Team 2020-12-18 07:31:08 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-22083


Note You need to log in before you can comment on or make changes to this bug.