GitHub Advisoryadvisory · PyPI

GHSA-8278-88vv-x98r Execution of untrusted code through config file

MEDIUM Published 2021-03-10 Modified 2024-10-27 Official page ↗
Aliases
CVE-2021-21371
Ecosystem
PyPI
Packages
tenable-jira-cloud
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-502
Reviewed
2021-03-10

Affected packages

• PyPI tenable-jira-cloud: < 1.1.21 → fixed in 1.1.21

Description

Impact It is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load() to yaml.safe_load() For more information If you have any questions or comments about this advisory: • Open an issue in tenable/integration-jira-cloud • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-21371 Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References