Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DataChain: Deserialization of Untrusted Data from Environment Variables
Vulnerability Description
DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Vulnerability Type
可信数据的反序列化
Vulnerability Title
DataChain 代码问题漏洞
Vulnerability Description
DataChain是Iterative开源的一个版本控制软件。 DataChain 0.34.1及之前版本存在代码问题漏洞，该漏洞源于从环境变量读取序列化对象时未验证数据，可能导致代码执行。
CVSS Information
N/A
Vulnerability Type
N/A