CVE-2020-22083: jsonpickle unsafe deserialization
(updated )
jsonpickle through 1.4.2 allows remote code execution during deserialization of a malicious payload through the decode() function. This CVE is disputed by the project author as intended functionality.
References
- access.redhat.com/security/cve/CVE-2020-22083
- gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874
- github.com/advisories/GHSA-j66q-qmrc-89rx
- github.com/j0lt-github/python-deserialization-attack-payload-generator
- github.com/jsonpickle/jsonpickle
- github.com/jsonpickle/jsonpickle/issues/332
- github.com/jsonpickle/jsonpickle/issues/332
- github.com/jsonpickle/jsonpickle/issues/335
- github.com/pypa/advisory-database/tree/main/vulns/jsonpickle/PYSEC-2020-49.yaml
- nvd.nist.gov/vuln/detail/CVE-2020-22083
- versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation
Detect and mitigate CVE-2020-22083 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →