PyPI/rpyc CVE-2019-16328: unknown, EPSS 13.05%
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
Action: Upgrade rpyc to 4.1.2 or later.
pip install rpyc==4.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.1.0 | 4.1.2 | - |
Fixed versions
| 4.1.2 |
Sources
- osv: PYSEC-2019-118
- https://rpyc.readthedocs.io/en/latest/docs/security.html
- https://github.com/tomerfiliba/rpyc
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00004.html
- https://github.com/advisories/GHSA-9ggp-4jpr-7ppj
- https://github.com/advisories/GHSA-pj4g-4488-wmxm
CVE-2019-16328 · published · modified · JSON