Skip to content
OpenAdvisories

Package · PyPI

fickling

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium —
    GHSA-5cxw-w2xg-2m8h

    fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`

    # Our assessment We added `platform` to the blocklist of unsafe modules (https://github.com/trailofbits/fickling/commit/351ed4d4242b447c0ffd550bb66b40695f3f9975). It was not possible to inject extra arguments to `file` without first monkey-patching `platform.…

    fickling PyPI
  • Medium —
    GHSA-r48f-3986-4f9c

    fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist

    # Our analysis As stated in the [project's security policy](https://github.com/trailofbits/fickling/security/policy), we also don't consider `UnusedVariables` bypasses to be security issues. We added several unsafe modules mentioned by the reporter in advisor…

    fickling PyPI
  • Medium —
    GHSA-mhc9-48gj-9gp3

    Fickling has safety check bypass via REDUCE+BUILD opcode sequence

    # Assessment It is believed that the analysis pass works as intended, `REDUCE` and `BUILD` are not at fault here. The few potentially unsafe modules have been added to the blocklist (https://github.com/trailofbits/fickling/commit/0c4558d950daf70e134090573450d…

    fickling PyPI