How can I report if there's a potential vulnerability

[William957-web]

I found out a vulnerability in this library, how can I report it?
Already reported cve.

[William957-web]

@piskvorky

[mpenkov]

I think you can just report the issue here

[William957-web]

@mpenkov @piskvorky
CVE-2024-35515

[piskvorky]

Thanks. Closing until there's a clearly demonstrated proof-of-concept or attack vector. Ideally with a mitigation PR where relevant.

[William957-web]

@piskvorky
https://william957-web.github.io/sqlitedict-vuln-report.zip
Additional details

[mpenkov]

Isn't this a problem with pickle, not with sqlitedict itself?

[William957-web]

@mpenkov
Probably not, for example, you won't say that code injection vulnerbility is the problem with eval.
In fact, there're serveral prevention due to pickle deserialization(like check object titles, sandboxes...), and ML often used libraries like clearML, pytorch also patched this kind of vulnerabilities.

[William957-web]

@mpenkov @piskvorky
patched version (Reference:https://docs.python.org/3/library/pickle.html):

import builtins
import io
import pickle

safe_builtins = {
    'range',
    'complex',
    'set',
    'frozenset',
    'slice',
}

class RestrictedUnpickler(pickle.Unpickler):

    def find_class(self, module, name):
        # Only allow safe classes from builtins.
        if module == "builtins" and name in safe_builtins:
            return getattr(builtins, name)
        # Forbid everything else.
        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
                                     (module, name))

def restricted_loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()

and change the decode and decode_key function's loads into restricted_loads.
The only drawback of this prevention is that user can't store other none builtin data types(like numpy or else(but I think the functions can be replaced just by sqlitedict!))...

[yoni13]

Just asking,is this vuln patched?

[mpenkov]

No, we didn't consider this worth patching, right @piskvorky ?

[piskvorky]

Correct.

[yoni13]

After I read those pdfs, I think add a warning to warn user don't load untrusted db file is actually enough.

What do you think @William957-web ?

[William957-web]

@yoni13
Yeah, I agree with your idea!
@piskvorky

[andreacortis]

does anyone know if there is any fork of this library that has been patched for this vulnerability?
FlairNLP depends on this sqlitedict and when you create a docker image, it show the vulnerability ... it does not look good

Any suggestions?

[William957-web]

does anyone know if there is any fork of this library that has been patched for this vulnerability? FlairNLP depends on this sqlitedict and when you create a docker image, it show the vulnerability ... it does not look good

Any suggestions?

Thanks for giving this issue, and after I did some code review on this package, the sqlitedict was used to store caches, that if a cache file has no chance to be edited by attacker, it should be safe!

[andreacortis]

Thank you for explaining that! It is a big relief!