Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 14 May 2020 15:14:51 -0300
From: Matheus Bratfisch <>
Subject: Python Beaker - Deserialization of Untrasted Data which can lead to
 Arbitrary code execution

Hello all,

python beaker is affected by Deserialization of untrusted data (CWE-502)
which could lead to Arbitrary code execution.

I believe it was initially pointed out the flaw on Session here:

Some improvements were made by adding a secret/HMAC but the Cache layer
still has the same flaw. I reported the flaw on cache level here:
I created a POC but didn't publish it on the ticket.

There is no CVE assigned to this.

This package exists on Fedora and Debian at least.

Should I take any extra action?

Best regards,
Matheus (X-warrior) Bratfisch.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.