CVE catalog
CVE-2019-16328
rpyc: CVE-2019-16328
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 13.05% · Oct 25, 2026
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rpyc | sid | 6.0.2-1 | not affected |
| Debian | rpyc | forky | 6.0.2-1 | not affected |
| Debian | rpyc | trixie | 6.0.1-1 | not affected |
| Debian | rpyc | bookworm | 5.3.0-2 | not affected |
| Opensuse | python-rpyc | tumbleweed | 6.0.2-1.5 | fixed |
| Opensuse | python-rpyc | leap 15.1 | 4.1.5-lp151.3.3.1 | fixed |
| Opensuse | python-rpyc-test | leap 15.1 | 4.1.5-lp151.3.3.1 | fixed |
| Suse | python-rpyc | package hub 15 sp1 | 4.1.5-bp151.2.3.1 | fixed |
| Suse | python-rpyc-test | package hub 15 sp1 | 4.1.5-bp151.2.3.1 | fixed |
| Opensuse | python-rpyc | tumbleweed | 6.0.0-1.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rpyc | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | rpyc | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | rpyc | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | rpyc | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Opensuse | python-rpyc | rpm | tumbleweed | 6.0.2-1.5 | Not reported | OPENSUSE-SU-2026:12040-1 | Not reported |
| Opensuse | python-rpyc | rpm | leap 15.1 | 4.1.5-lp151.3.3.1 | Not reported | OPENSUSE-SU-2020:0685-1 | Not reported |
| Opensuse | python-rpyc-test | rpm | leap 15.1 | 4.1.5-lp151.3.3.1 | Not reported | OPENSUSE-SU-2020:0685-1 | Not reported |
| Suse | python-rpyc | rpm | package hub 15 sp1 | 4.1.5-bp151.2.3.1 | Not reported | OPENSUSE-SU-2020:0763-1 | Not reported |
| Suse | python-rpyc-test | rpm | package hub 15 sp1 | 4.1.5-bp151.2.3.1 | Not reported | OPENSUSE-SU-2020:0763-1 | Not reported |
| Opensuse | python-rpyc | rpm | tumbleweed | 6.0.0-1.2 | Not reported | OPENSUSE-SU-2024:14162-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [python313-rpyc]Unknown
Source package: [python-rpyc]
Details (1)
6.0.2-1.5· noarch · tumbleweedUnknown · Fixed:
6.0.0-1.2, 6.0.2-1.5Version impact unknown
dsa · python-rpyc · opensuse · tumbleweed
- [python314-rpyc]Unknown
Source package: [python-rpyc]
Details (1)
6.0.2-1.5· noarch · tumbleweedUnknown · Fixed:
6.0.0-1.2, 6.0.2-1.5Version impact unknown
dsa · python-rpyc · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [python3-rpyc]Not affected
Source package: [rpyc]
Details (2)
5.3.0-2· all · bookwormNot affected
dsa · rpyc · debian · bookworm
5.3.0-2· all · bookwormNot affected
dsa · rpyc · debian · bookworm
- [python3-rpyc-doc]Not affected
Source package: [rpyc]
Details (2)
5.3.0-2· all · bookwormNot affected
dsa · rpyc · debian · bookworm
5.3.0-2· all · bookwormNot affected
dsa · rpyc · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0685-1.json]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2019-16328]
- [https://osv.dev/vulnerability/openSUSE-SU-2020:0685-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2020:0763-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14162-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:12040-1]
- [https://security-tracker.debian.org/tracker/CVE-2019-16328]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]