CVE-2013-5093
Published: 27 September 2013
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Notes
Author | Note |
---|---|
seth-arnold |
upstream 0.9.12 includes some XSS fixes that don't (yet?) have a CVE entry; a full update might be better. |
Priority
Status
Package | Release | Status |
---|---|---|
graphite-web
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
upstream |
Released
(0.9.11, 0.9.12)
|
|
Patches:
upstream: https://gist.github.com/mleinart/6285953 |