Headline
GHSA-4p4h-9gvq-7xfg: Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-93mv-x874-956g. This link is maintained to preserve external references.
Original Description
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-4p4h-9gvq-7xfg
Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
Moderate severity GitHub Reviewed Published Apr 24, 2025 to the GitHub Advisory Database • Updated Apr 24, 2025
Withdrawn This advisory was withdrawn on Apr 24, 2025
Package
pip picklescan (pip)
Affected versions
< 0.0.25
Published by the National Vulnerability Database
Apr 24, 2025
Published to the GitHub Advisory Database
Apr 24, 2025
Last updated
Apr 24, 2025