Code injection in rope

CRITICO 9.8CVE-2014-3539 · GHSA-r38r-qp28-2m63 · PYSEC-2018-100 · Published 06/04/2018 · updated 17/06/2026

In breve

CVE-2014-3539 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda rope, rope (rope project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.0%, superiore al 87.3% delle vulnerabilità.
Correzione: aggiornare a 0.11.0 o successiva.

Package	Affected versions	Patched versions
rope PyPI	`< 0.11.0`	`0.11.0`
rope rope_project	`< 0.11.0`	`0.11.0`

Description

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.

NVD description

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.

References

nvd.nist.gov/vuln/detail/CVE-2014-3539 · ADVISORY
python-rope/rope commit b01da7a · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
pypa/advisory-database · WEB
python-rope/rope · PACKAGE
openwall.com/lists/oss-security/2015/02/07/1 · WEB
GitHub Advisory GHSA-r38r-qp28-2m63 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free