Threats tagged 'ghsa-9cfw-f3f9-7mm7'

APScheduler versions 4.0.0a1 through 4.0.0a6 contain a critical remote code execution vulnerability in their JSONSerializer and CBORSerializer components due to insecure deserialization. The vulnerability arises from the unmarshal_object function, which allows arbitrary class instantiation and state injection by dynamically importing modules and invoking __setstate__ on any class in the Python environment. An attacker can exploit this by sending a specially crafted JSON or CBOR payload to an application using these serializers, potentially leading to full system compromise. Red Hat does not ship affected versions and no fix is currently provided by them.