Description
scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | powerpc-utils-python | 1.2.1-9.el7 | RHSA-2016:2607 |
Advisories 1
- RHSA-2016:2607 Red Hat Security Advisory: powerpc-utils-python security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [oss-security] 20150209 CVE-2014-8165: remote code execution in powerpc-utils-python mailing-list
- [Powerpc-utils-devel] 20140930 [RFC PATCH] amsvis/amsnet: Replace pickle with json mailing-list
- powerpcutils-cve20148165-code-exec(100788) vdb-entry
- RHSA-2016:2607 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1073139
- 72537 vdb-entry