abersheeran/rpc.py

abersheeran/rpc.py

GitHubGitHub
GitHubgithub.com
Releases14
Frequency1 month 2 weeks
Last Release
Stars205
A fast and powerful RPC framework based on ASGI/WSGI.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2022-35411↗
9.8 CRITICAL7.5 HIGH

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.