[<prev] [next>] [day] [month] [year] [list]
Message-ID: <59555074-b3a9-05d9-4411-2ed86222405d@apache.org>
Date: Mon, 29 Sep 2025 07:01:46 +0000
From: Chaokun Yang <chaokunyang@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-61622: Apache Fory: Python RCE via unguarded pickle
fallback serializer in pyfory
Severity: critical
Affected versions:
- Apache Fory (pyfory,pyfury) 0.5.0 through 0.12.2
Description:
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2 allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.
Users are recommended to upgrade to version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
Credit:
Mapta / BugBunny_ai (reporter)
References:
https://fory.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-61622
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
