CVE-2025-61622
🔴 Łataj teraz
Deserializacja niezaufanych danych w pyfory umożliwia zdalne wykonanie kodu.
CVSS
9.8
EPSS
43.5%
Exploit
none
Vendor
apache
Opis źródłowy (NVD)
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution. Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
deserialization rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 43.5% |
| Opublikowano (NVD) | 2025-10-01 10:15:34 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-09 09:10:00 UTC |
Referencje
- https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd ([email protected]) [Issue Tracking, Vendor Advisory]
- http://www.openwall.com/lists/oss-security/2025/09/29/3 (af854a3a-2127-422b-91ae-364da2661108) [Mailing List, Third Party Advisory]