CVE-2014-3539
Code injection in rope
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
CVE-2014-3539- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
CVE-2014-3539- Updated
- 2026-11-02
EUVDEUVD-2018-0132 No score
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
EUVD-2018-0132- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r38r-qp28-2m63
Code injection in rope
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
GHSA-r38r-qp28-2m63- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
CVE-2014-3539- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3539
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
DEBIAN-CVE-2014-3539- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-r38r-qp28-2m63
Code injection in rope
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
GHSA-r38r-qp28-2m63- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3539
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
UBUNTU-CVE-2014-3539- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2015-0122 No score
Updated python-rope packages fix security vulnerabilities
The python-rope utility has been caught passing remotely supplied data to pickle.load(), enabling possible code-execution attacks. This can happen when the 'perform_doa' (dynamic object analysis) option is enabled, which it previously had been by default.
This update changes the default configuration to disable this option. This only mitigates the issue, as it will still be vulnerable if the option is enabled.
If 'perform_doa' is enabled, python-rope can be persuaded to open under some circumstances a network port for short moment of time, which can be used to push commands to the running process, so the process could run some commands under the privileges of the user running python-rope. Anyone who enables this option is advised to make sure the computer is protected by a firewall.
- Record
MGASA-2015-0122- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10052-1 No score
python-rope-0.10.2-2.2 on GA media
These are all security issues fixed in the python-rope-0.10.2-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10052-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11267-1 No score
python36-rope-0.19.0-1.3 on GA media
These are all security issues fixed in the python36-rope-0.19.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11267-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14161-1 No score
python310-rope-1.12.0-1.3 on GA media
These are all security issues fixed in the python310-rope-1.12.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14161-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12039-1 No score
python313-rope-1.14.0-1.4 on GA media
These are all security issues fixed in the python313-rope-1.14.0-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12039-1- Updated
- 2026-11-02
OSVPYSEC-2018-100 No score
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
- Record
PYSEC-2018-100- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ropePyPI |
before 0.11.0 | 0.11.0 |
ropeDebian:12 |
before 0.10.3-1 | 0.10.3-1 |
ropeDebian:13 |
before 0.10.3-1 | 0.10.3-1 |
ropeDebian:14 |
before 0.10.3-1 | 0.10.3-1 |
ropePyPI |
before 0.11.0, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.10.50.10.60.10.70.20.2RC0.2pre20.2pre30.2pre40.2pre50.30.3m10.3m20.3m30.3m40.3m50.3rc10.40.4m10.4m20.4m30.4m40.4m50.4rc10.50.5m10.5m20.5m30.5m40.5m50.5rc10.60.6.10.6.20.6m10.6m20.6m30.6m40.6m50.6m60.70.7.10.7.20.7.30.7.40.7.5 |
0.11.0 |
python-ropeMageia:4 |
before 0.9.4-4.1.mga4 | 0.9.4-4.1.mga4 |
ropeUbuntu:16.04:LTS |
All versions, plus listed versions 0.10.2-1 |
None known |
python-ropeopenSUSE:Tumbleweed |
before 0.10.2-2.2 | 0.10.2-2.2 |
python-ropeopenSUSE:Tumbleweed |
before 0.19.0-1.3 | 0.19.0-1.3 |
python-ropeopenSUSE:Tumbleweed |
before 1.12.0-1.3 | 1.12.0-1.3 |
python-ropeopenSUSE:Tumbleweed |
before 1.14.0-1.4 | 1.14.0-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3539 is a critical vulnerability (CVSS 9.8) in Rope Project Rope, published April 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.97%, the 87th percentile. Fixed in rope 0.11.0.
References
openwall.com/lists/oss-security/2015/02/07/1
bugzilla.redhat.com/show_bug.cgi?id=1116485
nvd.nist.gov/vuln/detail/CVE-2014-3539
github.com/python-rope/rope/commit/b01da7aab5cd02129941d2a900e6e5e3b5f7d4fb
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2014-3539
advisories.mageia.org/MGASA-2015-0122.html
bugs.mageia.org/show_bug.cgi?id=15427
lists.opensuse.org/opensuse-updates/2015-03/msg00004.html
ubuntu.com/security/CVE-2014-3539
cve.org/CVERecord?id=CVE-2014-3539
suse.com/security/cve/CVE-2014-3539
Left out here: 14 versions. The JSON record has them.