From f676f9bf47301d7c9c27a519ced6e9eccb64871a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 14 Mar 2025 21:17:57 +0000 Subject: [PATCH] Publish GHSA-6m2c-76ff-6vrf --- .../2025/03/GHSA-6m2c-76ff-6vrf/GHSA-6m2c-76ff-6vrf.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/advisories/github-reviewed/2025/03/GHSA-6m2c-76ff-6vrf/GHSA-6m2c-76ff-6vrf.json b/advisories/github-reviewed/2025/03/GHSA-6m2c-76ff-6vrf/GHSA-6m2c-76ff-6vrf.json index 6ca00369ba4..e4bbf3243f3 100644 --- a/advisories/github-reviewed/2025/03/GHSA-6m2c-76ff-6vrf/GHSA-6m2c-76ff-6vrf.json +++ b/advisories/github-reviewed/2025/03/GHSA-6m2c-76ff-6vrf/GHSA-6m2c-76ff-6vrf.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6m2c-76ff-6vrf", - "modified": "2025-03-14T19:56:14Z", + "modified": "2025-03-14T21:16:47Z", "published": "2025-03-14T19:56:14Z", "aliases": [ "CVE-2025-2000" ], "summary": "Qiskit allows arbitrary code execution decoding QPY format versions < 13", - "details": "### Impact\n\nA maliciously crafted QPY file containing can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of specially constructed payload.\n\n### Patches\n\nFixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2", + "details": "### Impact\n\nA maliciously crafted QPY file containing can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.\n\n### Patches\n\nFixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2", "severity": [ { "type": "CVSS_V3",