Debian Patches

Status for deepdiff/8.1.1-4+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
0001-Security-fix-Prevent-class-pollution-and-remote-code.patch Security fix: Prevent class pollution and remote code execution in Delta

- Add validation to prevent traversing dunder attributes via check_elem()
- Harden Delta class against malicious pickle payloads
- Make SAFE_TO_IMPORT a frozenset for immutability
- Add comprehensive security tests in test_security.py
- Prevent access to __globals__ and other dangerous attributes		 Sep Dehpour <sep@zepworks.com> no 2025-09-03
0002-Fix-CVE-2026-33155.patch Fix (CVE-2026-33155)
deepdiff/serialization.py — Added a _SafeConstructor wrapper class that intercepts calls to
size-sensitive constructors (like bytes and bytearray) during pickle deserialization. When
find_class returns one of these types, it wraps it in _SafeConstructor, which validates that no
integer argument exceeds _MAX_ALLOC_SIZE (128MB) before allowing the call. This prevents payloads
like bytes(10**10) from causing memory exhaustion while still allowing legitimate small
allocations.

Tests

tests/test_serialization.py — Added TestPicklingSecurity class with two tests:
1. test_restricted_unpickler_memory_exhaustion_cve — Reproduces the attack with a crafted payload
attempting bytes(10_000_000_000), using resource.RLIMIT_AS to cap memory at 500MB as a safety net.
Verifies the fix raises UnpicklingError before any allocation.
2. test_restricted_unpickler_allows_small_bytes — Ensures legitimate bytes(100) payloads still
deserialize correctly.		 Sep Dehpour <sep@zepworks.com> no 2026-03-17

All known versions for source package 'deepdiff'

Links