Pyro Pickle Protocol Unauthenticated Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Pyro versions 3.16 and prior, due to unsafe deserialization of untrusted data by the pickle protocol. When a crafted pickled string message is sent to a Pyro server, it is deserialized without any authentication or integrity checks, allowing attackers to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability leads to unauthenticated remote code execution on the affected server.

Remediation

Users are advised to migrate to Pyro5, which does not use pickle for serialization by default and offers safer alternatives. If an immediate migration is not possible, Pyro3 should be used only over trusted networks and channels.