CVE-2019-12760 Deserialization vulnerability exists in parso
An attacker with write access to the cache directory can execute arbitrary code via malicious pickle files in the parso library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12760?
CVE-2019-12760 is a low-severity unsafe deserialization vulnerability in n/a, published on 6 Jun 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration.
Weakness: CWE-502
Which versions are affected by CVE-2019-12760?
3 open source packages ship an affected version, including parso. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
parso PyPI | All versions to 0.4.0 | None |
parso PyPI | All versions to 0.4.0 | None |
parso PyPI | All versions | 0.5.0 |
Products include Parso Project Parso.
How do I fix CVE-2019-12760?
Upgrade parso to 0.5.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-12760 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-12760 exists.
Sources
Also known as DEBIAN-CVE-2019-12760, GHSA-22mf-97vh-x8rw, PYSEC-2019-109.