CVE-2020-13091
1 advisory.
PyPI/pandas CVE-2020-13091: unknown
** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties
Action: Upgrade pandas to 1.0.4 or later.
pip install pandas==1.0.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.4 | - |
Fixed versions
| 1.0.4 |
Sources
- osv: PYSEC-2020-73
- https://github.com/0FuzzingQ/vuln/blob/master/pandas%20unserialize.md
- https://pandas.pydata.org/pandas-docs/stable/reference/api/pandas.read_pickle.html
CVE-2020-13091 · published · modified · JSON