CVE-2020-22083

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-12-22T13:56:10.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/j0lt-github/python-deserialization-attack-payload-generator"}, {"tags": ["x_refsource_MISC"], "url": "https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332"}, {"tags": ["x_refsource_MISC"], "url": "https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494"}, {"tags": ["x_refsource_MISC"], "url": "https://access.redhat.com/security/cve/CVE-2020-22083"}], "tags": ["disputed"], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-22083", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED ** jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/j0lt-github/python-deserialization-attack-payload-generator", "refsource": "MISC", "url": "https://github.com/j0lt-github/python-deserialization-attack-payload-generator"}, {"name": "https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/", "refsource": "MISC", "url": "https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/"}, {"name": "https://github.com/jsonpickle/jsonpickle/issues/332", "refsource": "MISC", "url": "https://github.com/jsonpickle/jsonpickle/issues/332"}, {"name": "https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874", "refsource": "MISC", "url": "https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874"}, {"name": "https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494", "refsource": "MISC", "url": "https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494"}, {"name": "https://access.redhat.com/security/cve/CVE-2020-22083", "refsource": "MISC", "url": "https://access.redhat.com/security/cve/CVE-2020-22083"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T14:51:09.499Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/j0lt-github/python-deserialization-attack-payload-generator"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://access.redhat.com/security/cve/CVE-2020-22083"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-22083", "datePublished": "2020-12-17T15:15:54.000Z", "dateReserved": "2020-08-13T00:00:00.000Z", "dateUpdated": "2024-08-04T14:51:09.499Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jsonpickle_project:jsonpickle:*:*:*:*:*:*:*:*", "matchCriteriaId": "71A1AAB5-F6D5-4BA1-94C4-92442D7606BC", "versionEndIncluding": "1.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data"}, {"lang": "es", "value": "** EN DISPUTA ** jsonpickle versiones hasta 1.4.1 permite una ejecuci\u00f3n de c\u00f3digo remota durante la deserializaci\u00f3n de una carga \u00fatil maliciosa por medio de la funci\u00f3n decode(). Nota: Se ha argumentado que se trata de un comportamiento esperado y claramente documentado. Se sabe que los pepinillos son capaces de causar la ejecuci\u00f3n arbitraria de c\u00f3digos, y no deben utilizarse con datos no fiables."}], "id": "CVE-2020-22083", "lastModified": "2026-06-17T03:04:07.290", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-17T16:15:12.610", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2020-22083"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/j0lt-github/python-deserialization-attack-payload-generator"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2020-22083"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/j0lt-github/python-deserialization-attack-payload-generator"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "python-jsonpickle: deserialization of a malicious payload in the decode function can lead to RCE", "id": "1908869", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908869"}, "csaw": false, "cvss3": {"cvss3_base_score": "0.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "status": "draft"}, "cwe": "CWE-502", "details": ["jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data", "Python-jsonpickle allows remote code execution during deserialization of a malicious payload through the decode() function."], "name": "CVE-2020-22083", "package_state": [{"cpe": "cpe:/a:redhat:ansible_tower:3", "fix_state": "Not affected", "package_name": "python-jsonpickle", "product_name": "Red Hat Ansible Tower 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Not affected", "package_name": "python-jsonpickle", "product_name": "Red Hat Quay 3"}], "public_date": "2020-12-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-22083\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-22083"], "statement": "Both jsonpickle and pickle are documented as being able to execute arbitrary code when loading pickles, and intended for use only with trusted data. This is expected behaviour, as clearly indicated in the jsonpickle README and at https://docs.python.org/3/library/pickle.html"}

{}