Executive brief
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
Affected products
- PyPI rpyc
Junglewise Threat Intelligence
PYSEC-2019-48 - In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c
Severity: info · Published 2019-10-03
Technologies: rpyc (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2024-44 - In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(c
- PYSEC-2019-118 - In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c