GHSA-vxp9-wv2f-wqmw

Deserialization of Untrusted Data in superset

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-8021

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	superset	< 0.23	0.23

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-8021 advisory
https://github.com/apache/incubator-superset/pull/4243 web
https://github.com/apache/superset/pull/4243 web
https://github.com/apache/superset/commit/2c72a7ae4fc0a8bac1f037a79efa90e1c5549710 web
https://github.com/advisories/GHSA-vxp9-wv2f-wqmw advisory
https://github.com/apache/superset package
https://github.com/pypa/advisory-database/tree/main/vulns/superset/PYSEC-2018-74.yaml web
https://www.exploit-db.com/exploits/45933 web