PyPI/fickling: high
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
Action: Upgrade fickling to 0.1.9 or later.
pip install fickling==0.1.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.1.9 | - |
Fixed versions
| 0.1.9 |
Sources
- osv: GHSA-wccx-j62j-r448
- https://github.com/trailofbits/fickling/security/advisories/GHSA-wccx-j62j-r448
- https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7
- https://github.com/trailofbits/fickling
- https://github.com/trailofbits/fickling/releases/tag/v0.1.9
published · modified · JSON