CVE-2025-56005：PLY 中存在争议的不安全反序列化风险 ZXCVFIXVIBESEND ZXCVFIXVIBESEG1 CVE-2025-56005 有争议。了解 PLY 解析器表 pickle 加载何时跨越信任边界、如何删除它以及 ZXCVFIXVIBETOKEN1ZXCV 存储库扫描验证的内容。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG2 PLY 解析器构建可以选择通过 Python pickle 加载解析器表。仅当不受信任的参与者可以影响现有的 pickle 文件或其路径时，这才会成为代码执行风险。 CVE-2025-56005 存在争议，因此 ZXCVFIXVIBETOKEN1ZXCV 将显式存储库配置报告为可能的问题，而不是将原始关键 RCE 声明视为已证实的问题。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG3 ## 咨询状态 ZXCVFIXVIBESEND ZXCVFIXVIBESEG4 ZXCVFIXVIBETOKEN2ZXCV 通过 PLY 的解析器表 pickle 支持描述了不安全的反序列化。当前的 ZXCVFIXVIBETOKEN3ZXCV/ZXCVFIXVIBETOKEN4ZXCV 记录带有争议注释：第三方认为已发布的证明并未证明任意代码执行。红帽将这个问题视为与上下文相关的问题，并将其评为“重要”，而不是接受最初的普遍严重评级。 CVE-2025-56005 ZXCVFIXVIBETOKEN1ZXCV ZXCVFIXVIBESEND ZXCVFIXVIBESEG5 ## 当风险真实存在时 ZXCVFIXVIBESEND ZXCVFIXVIBESEG6 PLY 3.11 源接受解析器表 pickle 路径，并且当存在现有文件时，使用 Python 的 pickle 加载器读取它。 Python pickle 跨信任边界并不安全，因为加载精心设计的数据可以执行代码。因此，危险情况需要显式使用解析器表 pickle 功能，以及一种让不太受信任的用户、上传路径、构建作业、共享卷、同级服务或受损工件源创建或替换文件的方法。 CVE-2025-56005 ZXCVFIXVIBETOKEN1ZXCV ZXCVFIXVIBESEND ZXCVFIXVIBESEG7 仅存储库证据无法证明解析器在生产中运行、文件存在或攻击者可以影响它。这些部署和文件系统问题决定了配置是否可利用。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG8 ## 具体修复 ZXCVFIXVIBESEND ZXCVFIXVIBESEG9 1. 从 PLY 解析器构造中删除解析器表 pickle 选项。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 2. 通过 PLY 的正常构建/导入路径从可信语法源生成解析器表。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 3. 在重建之前从源代码管理、构建输出、缓存、容器层、工件存储和部署的卷中删除旧的解析器表 pickle 文件。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 4. 检查构建和运行时目录所有权，以便上传、租户、用户、CI 作业和同级服务无法替换解析器工件。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 5. 运行正常的解析器回归测试并从干净的工作区重建。不要打开可疑的pickle来测试它是否是恶意的。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG14 审查的来源并未识别出已修补的 PLY 版本，PyPI 仍将 3.11 列为当前版本。删除不安全的配置是直接补救措施，而不是等待仅版本修复。 CVE-2025-56005 ZXCVFIXVIBETOKEN1ZXCV ZXCVFIXVIBESEND ZXCVFIXVIBESEG15 ## CVE-2025-56005 如何覆盖它 ZXCVFIXVIBESEND ZXCVFIXVIBESEG16 **由 CVE-2025-56005 覆盖。** 授权的 ZXCVFIXVIBETOKEN1ZXCV 存储库扫描审查 Python 解析器配置，以明确使用 PLY 的不安全解析器表反序列化路径。调查结果被报告为源位置可能存在高度严重的问题，并列出了尚未核实的内容的清晰清单。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG17 CVE-2025-56005 不会打开解析器表文件、执行 Python 有效负载、运行解析器或从存储库证据中声明远程代码执行。它本身也不会标记 PLY 依赖项；存储库必须包含不安全的源配置。

Advisory status

CVE-2025-56005 describes unsafe deserialization through PLY's parser-table pickle support. The current NVD/CVE record carries a dispute note: a third party argues that the published proof does not demonstrate arbitrary code execution. Red Hat treats the issue as context-dependent and rates it Important rather than accepting the original universal critical rating. [S1] [S2]

When the risk is real

PLY 3.11 source accepts a parser-table pickle path and, when an existing file is present, reads it with Python's pickle loader. Python pickle is not safe across trust boundaries because loading crafted data can execute code. The dangerous condition therefore requires both explicit use of the parser-table pickle feature and a way for a less-trusted user, upload path, build job, shared volume, sibling service, or compromised artifact source to create or replace the file. [S2] [S3]

Repository evidence alone cannot prove that the parser runs in production, that the file exists, or that an attacker can influence it. Those deployment and filesystem questions determine whether the configuration is exploitable.

Concrete fixes

• Remove the parser-table pickle option from PLY parser construction.
• Generate parser tables from trusted grammar source through PLY's normal build/import path.
• Delete old parser-table pickle files from source control, build outputs, caches, container layers, artifact stores, and deployed volumes before rebuilding.
• Review build and runtime directory ownership so uploads, tenants, users, CI jobs, and sibling services cannot replace parser artifacts.
• Run normal parser regression tests and rebuild from a clean workspace. Do not open a suspicious pickle to test whether it is malicious.

The reviewed sources do not identify a patched PLY release, and PyPI still lists 3.11 as the current release. Removing the unsafe configuration is the direct remediation rather than waiting for a version-only fix. [S2] [S4]

How FixVibe covers it

Covered by FixVibe. Authorized GitHub repository scans review Python parser configuration for explicit use of PLY's unsafe parser-table deserialization path. Findings are reported as high-severity likely issues with the source location and a clear list of what remains unverified.

FixVibe does not open parser-table files, execute Python payloads, run the parser, or claim remote code execution from repository evidence. It also does not flag a PLY dependency by itself; the repository must contain the unsafe source configuration.