Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-27758

Good to know:

icon
icon

Date: March 11, 2024

In RPyC before 6.0.0, when a server exposes a method that calls the attribute named array for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that results in remote code execution.

Language: Python

Severity Score

Related Resources (10)

https://github.com/tomerfiliba-org/rpyc/blob/5.3.1/rpyc/core/netref.py#L252-L255
https://github.com/tomerfiliba-org/rpyc
https://gist.github.com/renbou/957f70d27470982994f12a1d70153d09
https://nvd.nist.gov/vuln/detail/CVE-2024-27758
https://github.com/tomerfiliba-org/rpyc/commit/bba1d3562e6f9f1256ec64048cc23001c0bb7516
https://security-tracker.debian.org/tracker/CVE-2024-27758
https://github.com/tomerfiliba-org/rpyc/security/advisories/GHSA-h5cg-53g7-gqjw
https://github.com/pypa/advisory-database/tree/main/vulns/rpyc/PYSEC-2024-44.yaml
https://github.com/tomerfiliba-org/rpyc/commit/9f45f8269d4106905db61d82cd529cacdb178911
https://www.mend.io/vulnerability-database/CVE-2024-27758

Severity Score

Weakness Type (CWE)

Improper Control of Dynamically-Managed Code Resources

CWE-913

Improperly Implemented Security Check for Standard

CWE-358

Missing Authentication for Critical Function

CWE-306

Top Fix

icon

Upgrade Version

Upgrade to version rpyc - 6.0.0;rpyc - 6.0.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us