GitHub Advisoryadvisory · PyPI

GHSA-9q2p-fj49-vpxj In marshmallow library the schema "only" option treats an empty list as implying no "only" option

MEDIUM Published 2018-10-10 Modified 2024-09-24 Official page ↗
Aliases
CVE-2018-17175
Ecosystem
PyPI
Packages
marshmallow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-358
Reviewed
2020-06-16

Affected packages

• PyPI marshmallow: < 2.15.1 → fixed in 2.15.1 • PyPI marshmallow: >= 3.0a0, < 3.0.0b9 → fixed in 3.0.0b9

Description

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").

Related

Alias · CVE (1)

  • CVE-2018-17175 In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no… vulnerability

Weakness · CWE (1)

  • CWE-358 Improperly Implemented Security Check for Standard weakness

References