CVE-2005-2875 Py2Play Unpickles Untrusted Objects
Remote attackers can execute arbitrary Python code in Py2Play by sending malicious pickled objects, requiring immediate library upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-2875?
CVE-2005-2875 is a high-severity unsafe deserialization vulnerability in n/a, published on 13 Sep 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.
Which versions are affected by CVE-2005-2875?
3 open source packages ship an affected version, including py2play and Py2Play. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
py2play PyPI | All versions to 0.1.8 | None |
py2play PyPI | All versions to 0.1.8 | None |
Py2Play PyPI | All versions to 0.1.8 | None |
Products include Py2play Py2play.
How do I fix CVE-2005-2875?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2005-2875 being exploited?
There is no known exploitation of CVE-2005-2875 in the wild and no public exploit code.
Sources
Also known as DSA-856-1, GHSA-wcpc-f63g-x26q, PYSEC-2026-742.