Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-56005: An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | policycoreutils | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-dbus | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-debuginfo | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-debugsource | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-devel | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-devel-debuginfo | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-gui | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-newrole | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-newrole-debuginfo | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-python-utils | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-restorecond | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | policycoreutils-restorecond-debuginfo | 0:3.4-6.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-policycoreutils | 0:3.4-6.amzn2023.0.3 |
Vulnerabilities 1
-
Critical 9.8
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-56005.html