Duplicate Advisory: Possible remote code execution via a remote procedure call

HIGH 7.5CVE-2019-16328 · GHSA-9ggp-4jpr-7ppj · GHSA-pj4g-4488-wmxm · Published 03/10/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
rpyc PyPI	`≥ 4.1.0, < 4.1.1≥ 4.1.0, < 4.1.2`	`4.1.14.1.2`
rpyc rpyc_project	`≥ 4.1.0, ≤ 4.1.1`	No fix yet

Description

Withdrawn: duplicate of GHSA-pj4g-4488-wmxm

Original Description

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-16328 · ADVISORY
GitHub Advisory GHSA-9ggp-4jpr-7ppj · ADVISORY
GitHub Advisory GHSA-pj4g-4488-wmxm · ADVISORY
pypa/advisory-database · WEB
tomerfiliba/rpyc · WEB
rpyc.readthedocs.io/en/latest/docs/security.html · WEB
lists.opensuse.org/opensuse-security-announce/2020-05/msg00046.html · WEB
lists.opensuse.org/opensuse-security-announce/2020-06/msg00004.html · WEB
tomerfiliba-org/rpyc security advisory · WEB
tomerfiliba-org/rpyc · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free