CVE-2013-5942

Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to (1) remote_storage.py, (2) storage.py, (3) render/datalib.py, and (4) whitelist/views.py, a different vulnerability than CVE-2013-5093.

• How can I get the fixes?
• What do statuses mean?

References

• MITRE
• NVD
• Launchpad
• Debian

Other references

• https://github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rst
• http://secunia.com/advisories/54556
• http://www.openwall.com/lists/oss-security/2013/09/27/10
• https://www.cve.org/CVERecord?id=CVE-2013-5942