[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Steve Dower added the comment: Thanks for reporting this. In future, security issues should be reported *first* through https://www.python.org/dev/security/ *Do not* request a CVE number until we've reviewed it. It causes unnecessary stress for our users who actually pay attention to those

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Junyu Zhang added the comment: Thank you for your reply. Yes, under normal circumstances, keys are generally not leaked. I may have only considered the following attacks at the time: 1. If the client script of the distributed process is on another machine, or the key is leaked due to

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

STINNER Victor added the comment: > if authkey is not set or leaked, it will cause RCE on the server side In which situation the authkey can be empty? Lib/mulitprocessing/process.py creates an authkey of 256 bits of entropy using: AuthenticationString(os.urandom(32)) It's used by default if

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Change by STINNER Victor : Added file: https://bugs.python.org/file48999/poc.py ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

STINNER Victor added the comment: Oh, I missed that the PDF contains a link to a PoC: https://github.com/RGDZ-GZU/Python-Remote-code-exec/tree/master/poc I attach a copy to this issue: server.py and poc.py. -- Added file: https://bugs.python.org/file48998/server.py

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

STINNER Victor added the comment: Lib/multiprocessing/connection.py uses a challenge to authenticate the client. How do you connect to the server? Yes, it's known that pickle is not safe, there is a big red warning at the top of the doc: https://docs.python.org/dev/library/pickle.html But

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Junyu Zhang added the comment: Thank you for your reply, this report is indeed the situation prompted by the warning. There will be few problems in the single-machine deployment mode. Of course, it is also possible to take advantage of the possibility of elevation of privilege. In the

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Change by Kubilay Kocak : -- nosy: +koobs ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Karthikeyan Singaravelan added the comment: I am not sure if this was done but CPython has a page on reporting security issues that you can use for future reports so that they can be triaged before being public. https://www.python.org/dev/security/ -- nosy: +vstinner

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Karthikeyan Singaravelan added the comment: Thanks for the report. Is this a case of the warning below? https://docs.python.org/3.8/library/multiprocessing.html#multiprocessing.connection.Connection.recv > Warning The Connection.recv() method automatically unpickles the data it > receives,

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Change by SilentGhost : -- nosy: +davin, pitrou ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

New submission from Junyu Zhang : description: When we were using python to develop a distributed process service, I noticed that the default serialization parameter of Manager and ManagerBase in multiprocessing was pickl, and it didn't seem to be mentioned in the official website's

[issue40039] [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability

Change by Junyu Zhang : -- components: Library (Lib) files: Python-multiprocessing-RCE-vulnerability.pdf nosy: Junyu Zhang priority: normal severity: normal status: open title: [CVE-2020-10796] Python multiprocessing Remote Code Execution vulnerability type: security versions: Python