CVE-2021-47952
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
वीकनेस
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
संदर्भ
- https://github.com/jsonpickle/jsonpickle
- https://jsonpickle.github.io
- https://www.exploit-db.com/exploits/49585
- https://www.vulncheck.com/advisories/python-jsonpickle-remote-code-execution-via-py-repr
- https://access.redhat.com/security/cve/CVE-2021-47952
- https://bugzilla.redhat.com/show_bug.cgi?id=2478170
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।