vulnwire
7.5high

CVE-2005-2875

Py2Play Unpickles Untrusted Objects

Also known as GHSA-wcpc-f63g-x26q, PYSEC-2026-742

Published 21 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known

Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.

Exploit prediction (EPSS)

1.91% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

EcosystemPackageAffectedFixed in
pypipy2play
<=0.1.8
no fix listed

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

  • secunia.com /advisories/16855 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=326976 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2005/dsa-856 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/14864 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/17106 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • soya.literati.org / · x_refsource_MISC, x_transferred
  • gentoo.org /security/en/glsa/glsa-200509-09.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • bugs.gentoo.org /show_bug.cgi?id=103524 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2005-2875 · advisory
  • web.archive.org /web/20040824010038/http://home.gna.org/oomadness/fr/slune/index.html · web
  • web.archive.org /web/20050213041706/http://soya.literati.org · web
  • web.archive.org /web/20161225000907/http://www.securityfocus.com/bid/14864 · web
  • pypi.org /project/py2play · package
  • github.com /advisories/GHSA-wcpc-f63g-x26q · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.