~ / search / GHSA-jqmc-fxxp-r589

GHSA-jqmc-fxxp-r589

Deserialization of Untrusted Data in Tendenci

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-14942

Packages

EcosystemPackageAffectedFixed in
PyPI tendenci < 12.0.11 12.0.11

Details

As written in the advisory (Markdown source, shown as plain text).

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.

References

External links from the advisory. They lead to third-party sites.