Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EPyT-Flow has unsafe JSON deserialization (__type__)
Vulnerability Description
EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
可信数据的反序列化
Vulnerability Title
EPyT-Flow 代码问题漏洞
Vulnerability Description
EPyT-Flow是ERC Synergy Grant Water Futures开源的一个用于生成配水网络的水力和水质场景数据的Python包。 EPyT-Flow 0.16.1之前版本存在代码问题漏洞，该漏洞源于REST API使用支持类型字段的自定义反序列化器解析攻击者控制的JSON请求体，可能导致OS命令执行。
CVSS Information
N/A
Vulnerability Type
N/A