Statement on CVE-2024-27322
blog.r-project.org
Statement on CVE-2024-27322
1–10 of 51 posts
Re: Statement on CVE-2024-27322
#2tl;dr R has its own pickle.load and someone decided to milk a CVE [1] out of this fact.
[1] and a blog post for bragging, thankfully they didn't do a name and a logo.
Re: Statement on CVE-2024-27322
#3Have there been more CVEs lately, or did the whole Jia Tian thing make them rank higher on HN?
Re: Statement on CVE-2024-27322
#4tl;dr R has its own pickle.load and someone decided to milk a CVE [1] out of this fact. [1] and a blog post for bragging, thankfully they didn't do a name and a logo.
Blog post in question: https://hiddenlayer.com/research/r-bitrary-code-execution/
Re: Statement on CVE-2024-27322
#5> This is a brief statement on behalf or the R Core Team on the serialization bug recently reported by the cybersecurity form HiddenLayer.
Cybersecurity firm, surely? Of all the things not to proofread … a press release.
Re: Statement on CVE-2024-27322
#6Have there been more CVEs lately, or did the whole Jia Tian thing make them rank higher on HN?
For example 2023q1 vs 2024q1: 7,015 vs 8,697 [1].
Re: Statement on CVE-2024-27322
#7Have there been more CVEs lately, or did the whole Jia Tian thing make them rank higher on HN?
I'd imagine a bit of both. More people looking for issues because of it, and then also because of something so high profile people are more likely to pay attention and upvote because they've seen more recently.
Re: Statement on CVE-2024-27322
#8tl;dr R has its own pickle.load and someone decided to milk a CVE [1] out of this fact. [1] and a blog post for bragging, thankfully they didn't do a name and a logo.
This is uncharitable.
From what I can tell, these RDS files are a common way of sharing data among R users. I would be relatively surprised if reading someone else's dataset was able to execute arbitrary code.
I think this is more like if reading a CSV via numpy could execute code.
Re: Statement on CVE-2024-27322
#9tl;dr R has its own pickle.load and someone decided to milk a CVE [1] out of this fact. [1] and a blog post for bragging, thankfully they didn't do a name and a logo.
This is uncharitable. From what I can tell, these RDS files are a common way of sharing data among R users. I would be relatively surprised if reading someone else's dataset was able to execute arbitrary code. I think this is more like if reading a CSV via numpy could execute code.
.pkl files were, are, and will still be a a common way of sharing data among Python users. Despite it is known to be unsafe since forever and nobody claimed a CVE for this fact.
A few years back I have heard from a lot of people working in ML communities that they are surprised that `numpy.load` is able to execute arbitrary code.
Re: Statement on CVE-2024-27322
#10Earlier quoted context omitted.
This is uncharitable. From what I can tell, these RDS files are a common way of sharing data among R users. I would be relatively surprised if reading someone else's dataset was able to execute arbitrary code. I think this is more like if reading a CSV via numpy could execute code.
.pkl files were, are, and will still be a a common way of sharing data among Python users. Despite it is known to be unsafe since forever and nobody claimed a CVE for this fact. A few years back I have heard from a lot of people working in ML communities that they are surprised that `numpy.load` is able to execute arbitrary code.
Weird. I don't think I've ever relied on pickle for sharing data. It's too version specific. I always dump to json, or similar.