Description (CNA)
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| trailofbits / fickling | affected < 0.1.6 |
CWE
CWE-184, CWE-502, CWE-94
References
- https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2
- https://github.com/trailofbits/fickling/pull/108
- https://github.com/trailofbits/fickling/pull/187
ADP enrichment
No English description supplied.
No references supplied.