CVE-2019-17206: Uncontrolled Deserialization in Frost Ming Redis Wrapper
Summary
CVE-2019-17206: Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts. Affects rediswrapper versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Frost Ming Redis Wrapper (also known as Redis Wrapper) is a Python package available on PyPI. It provides a convenient interface for interacting with Redis, a popular in-memory data structure store. The package allows users to perform various operations on Redis, such as storing and retrieving data. However, versions prior to 0.3.0 are vulnerable to uncontrolled deserialization of pickled objects in the models.py file. This vulnerability can be exploited by attackers to execute arbitrary scripts.
Vulnerability Detail
The vulnerability arises from the lack of proper input validation and sanitization when deserializing pickled objects in the models.py file of Frost Ming Redis Wrapper. An attacker can craft a malicious pickled object and pass it to the vulnerable code, leading to the execution of arbitrary scripts with the privileges of the application. This can result in unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Minimum fixed version
0.3.0
This is the first release that contains the fix.
pip install --upgrade "rediswrapper==0.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Frost Ming Redis Wrapper (CVE-2019-17206) allows attackers to execute arbitrary scripts by exploiting uncontrolled deserialization of pickled objects. To mitigate this risk, users should upgrade to version 0.3.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rediswrapper →
FAQ
The vulnerability allows attackers to execute arbitrary scripts, potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
No, only versions prior to 0.3.0 are vulnerable. Users should upgrade to the latest version to mitigate the risk.
No, authentication is not required. An attacker can exploit the vulnerability remotely without any prior authentication.
At the time of this advisory, there is no known public exploit available for this vulnerability.
Currently, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Frost Ming Redis Wrapper.
References
Related vulnerabilities
Recent vulnerabilities recorded for rediswrapper.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
