CVE-2019-16328

Advisory

Rpyc 4.1.2 includes a fix for CVE-2019-16328: a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Fixed `CVE-2019-16328`_ which was caused by a missing protocol security check
- Fixed RPyC over RPyC for mutable parameters and extended unit testing for `346`_

.. _CVE-2019-16328: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16328
.. _346: https://github.com/tomerfiliba/rpyc/issues/346

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16328
• https://rpyc.readthedocs.io/en/latest/docs/security.html
• https://github.com/tomerfiliba/rpyc
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00046.html
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00004.html