CVE-2025-46417

Summary

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.

Affected Software

VendorProductVersion RangeStatus
PicklescanPicklescan0 < 0.0.25affected

Weaknesses

  • CWE-184: CWE-184 Incomplete List of Disallowed Inputs

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References