Bugzilla – Bug 1137629
VUL-0: CVE-2019-12760: python-parso: parsing leads to arbitrary code execution
Last modified: 2024-05-06 13:18:20 UTC
rh#1718212 A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. Upstream commit: https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7 References: https://bugzilla.redhat.com/show_bug.cgi?id=1718212 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12760 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12760 https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7
The above commit link is not the fix it is the reproducer.
marketa, as you touched it last in opensuse and it has no maintainer, can you check it out?
Well, there is an upstream disscussion: https://github.com/davidhalter/parso/issues/75. It is quite long and quite exhaustive. In short: upstream agrees it is an issue, but does not consider it serious, they mostly think it appears in a case parso was never meant to be used. Nevertheless, they have "documented" it: https://github.com/davidhalter/parso/commit/19de3eb5ca1ae9e7994f8d72f83328d83538fd16 and opened an issue to replace pickles: https://github.com/davidhalter/parso/issues/79, but they claim it is not easy to fix it and it could take a long time. Regarding this disscussion I think we can wait, because it is, as they say, unlikely to encounter in the wild.
https://github.com/davidhalter/parso/issues/172 To cite upstream: "This is not a vulnerability". So they are probably not going to fix it. I propose to close this bug as WONTFIX. Security, what do you think?
I agree with upstream that this is a not vulnerability. Upstream doesn't plan to fix at all, and the CVE is officially disputed. Let's close this as WONTFIX