CVE-2020-22083 jsonpickle unsafe deserialization
Remote attackers can execute arbitrary code by sending malicious payloads to the jsonpickle decode function, affecting applications using this Python library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-22083?
CVE-2020-22083 is a critical unsafe deserialization vulnerability in n/a, published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data
Weakness: CWE-502
Which versions are affected by CVE-2020-22083?
3 open source packages ship an affected version, including jsonpickle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jsonpickle PyPI | All versions to 1.4.2 | None |
jsonpickle PyPI | All versions to 1.4.2 | None |
jsonpickle PyPI | All versions | 1.4.2 |
Products include Jsonpickle Project Jsonpickle.
How do I fix CVE-2020-22083?
Upgrade jsonpickle to 1.4.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-22083 being exploited?
There is no known exploitation of CVE-2020-22083 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-22083, GHSA-j66q-qmrc-89rx, PYSEC-2020-49.