GHSA-4p4h-9gvq-7xfg: Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

April 24, 2025

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-93mv-x874-956g. This link is maintained to preserve external references.

Original Description

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.

References

github.com/advisories/GHSA-4p4h-9gvq-7xfg
github.com/advisories/GHSA-93mv-x874-956g
github.com/mmaitre314/picklescan/pull/40
nvd.nist.gov/vuln/detail/CVE-2025-46417

Code Behaviors & Features

Detect and mitigate GHSA-4p4h-9gvq-7xfg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →