Description
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Picklescan | Picklescan | < 0.0.25 | 0.0.25 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | picklescan | < 0.0.25 | 0.0.25 | GHSA-93mv-x874-956g |