Deserialization of Untrusted Data in superset
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-8021US | critical9.8 | Exploit | ||
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-vxp9-wv2f-wqmwADVISORY
- https://github.com/apache/incubator-superset/pull/4243WEB
- https://github.com/apache/supersetPACKAGE
- https://github.com/apache/superset/commit/2c72a7ae4fc0a8bac1f037a79efa90e1c5549710WEB
- https://github.com/apache/superset/pull/4243WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/superset/PYSEC-2018-74.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-8021ADVISORY
- https://www.exploit-db.com/exploits/45933WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan