Code injection in rope

심각 9.8CVE-2014-3539 · GHSA-r38r-qp28-2m63 · PYSEC-2018-100 · Published 06/04/2018 · updated 17/06/2026

요약

CVE-2014-3539은(는) rope, rope (rope project)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 3.0%, 전체 취약점의 87.3%보다 높음.
조치: 0.11.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
rope PyPI	`< 0.11.0`	`0.11.0`
rope rope_project	`< 0.11.0`	`0.11.0`

Description

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.

NVD description

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.

References

nvd.nist.gov/vuln/detail/CVE-2014-3539 · ADVISORY
python-rope/rope commit b01da7a · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
pypa/advisory-database · WEB
python-rope/rope · PACKAGE
openwall.com/lists/oss-security/2015/02/07/1 · WEB
GitHub Advisory GHSA-r38r-qp28-2m63 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free