GLSA-200509-09 : Py2Play: Remote execution of arbitrary Python code
High Nessus Plugin ID 19741
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200509-09 (Py2Play: Remote execution of arbitrary Python code)
Arc Riley discovered that Py2Play uses Python pickles to send objects over a peer-to-peer game network, and that clients accept without restriction the objects and code sent by peers.
A remote attacker participating in a Py2Play-powered game can send malicious Python pickles, resulting in the execution of arbitrary Python code on the targeted game client.
There is no known workaround at this time.
SolutionAll py2play users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=dev-python/py2play-0.1.8'