CVE-2020-13091: Critical severity Numfocus Pandas vulnerability
DISPUTED pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the readpickle() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the readpickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13091?
The severity of CVE-2020-13091 is disputed, but it involves the risk of executing commands from untrusted files.
How do I fix CVE-2020-13091?
To mitigate CVE-2020-13091, avoid using the read_pickle() function with untrusted input.
Which versions are affected by CVE-2020-13091?
CVE-2020-13091 affects pandas versions up to 1.0.3 and IBM Concert Software from versions 1.0.0 to 2.1.0.
What functions are related to CVE-2020-13091?
CVE-2020-13091 specifically involves the read_pickle() function in pandas.
Is CVE-2020-13091 being contested?
Yes, the vulnerability in CVE-2020-13091 is disputed due to the known risks of the read_pickle() function.