CVE-2014-3539 Code injection in rope
Remote attackers can execute arbitrary code via unsafe pickle deserialization in the Rope library's DOA module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3539?
CVE-2014-3539 is a critical unsafe deserialization vulnerability in n/a, published on 6 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
Which versions are affected by CVE-2014-3539?
3 open source packages ship an affected version, including rope. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rope PyPI | All versions | 0.11.0 |
rope PyPI | All versions | 0.11.0 |
rope PyPI | All versions | 0.11.0 |
Linux distribution packages (4)
python-rope openSUSE:Tumbleweed | All versions | 0.10.2-2.2 |
python-rope openSUSE:Tumbleweed | All versions | 0.19.0-1.3 |
python-rope openSUSE:Tumbleweed | All versions | 1.12.0-1.3 |
python-rope openSUSE:Tumbleweed | All versions | 1.14.0-1.4 |
Products include Rope Project Rope.
How do I fix CVE-2014-3539?
Upgrade rope to 0.11.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2014-3539 being exploited?
There is no known exploitation of CVE-2014-3539 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2014-3539, GHSA-r38r-qp28-2m63, MGASA-2015-0122, PYSEC-2018-100, UBUNTU-CVE-2014-3539, openSUSE-SU-2024:10052-1 and 3 more.