S3ql Project : Security Vulnerabilities, CVEs,
S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is related to the checksum_basic_mapping function.
Max CVSS
7.5
EPSS Score
0.08%
Published
2018-06-10
Updated
2019-03-08
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.
Max CVSS
7.5
EPSS Score
3.81%
Published
2014-09-02
Updated
2014-09-03
2 vulnerabilities found