CVE-2013-5093
Published: 27 September 2013
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Notes
| Author | Note |
|---|---|
| seth-arnold |
upstream 0.9.12 includes some XSS fixes that don't (yet?) have a CVE entry; a full update might be better. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
graphite-web
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
| precise |
Does not exist
|
|
| quantal |
Does not exist
|
|
| raring |
Does not exist
|
|
| upstream |
Released
(0.9.11, 0.9.12)
|
|
|
Patches:
upstream: https://gist.github.com/mleinart/6285953 |
||