Author stephen.farris
Recipients Guido.van.Rossum, lemburg, stephen.farris
Date 2014-11-16.18:39:00
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
The dumbdbm module uses an unchecked call to eval() in the _update method, which is called in response to a call to, and is used to load the index from the directory file.  This poses a security vulnerability because it allows an attacker to execute arbitrary code on the victim's machine by inserting python code into the DBM directory file.  This vulnerability could allow an attacker to execute arbitrary commands on the victim machine, potentially allowing them to deploy malware, gain system access, destroy files and data, expose sensitive information, etc.
Date User Action Args
2014-11-16 18:39:01stephen.farrissetrecipients: + stephen.farris, lemburg, Guido.van.Rossum
2014-11-16 18:39:01stephen.farrissetmessageid: <>
2014-11-16 18:39:00stephen.farrislinkissue22885 messages
2014-11-16 18:39:00stephen.farriscreate