p PatchFirst

CVE-2025-62515

CVE-2025-62515 · Remote Code Execution by Pickle Deserialization via FlightServer in pyquokka

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data.

CVSS 9.8 · Critique · EPSS 0,9%

Publication
Mise à jour

Pile logicielle: python

Produits et versions concernés

  • quokka

    Versions du logiciel
    • <= 3.0.1: Concernée

    Aucun correctif publié

  • pyquokka PyPI

    Versions du logiciel
    • 0.0.8
    • 0.1.0
    • 0.1.1
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.5
    • 0.2.0
    • 0.2.1
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6
    • 0.2.7
    • 0.2.8
    • 0.2.9
    • 0.3.0
    • 0.3.1
    Plages de versions concernées
    • ECOSYSTEM: ≤ 0.3.1

    Aucun correctif publié

Sources originales

Vérifiez votre serveur →