GitHub Advisoryadvisory · PyPI

GHSA-ggmr-44cv-24pm Code injection via unsafe YAML loading

HIGH Published 2021-12-09 Modified 2024-10-25 Official page ↗
Aliases
CVE-2021-43811
Ecosystem
PyPI
Packages
sockeye
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2021-12-08

Affected packages

• PyPI sockeye: < 2.3.24 → fixed in 2.3.24

Description

Impact Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. Patches The issue is fixed in version 2.3.24 and above by #964. For more information If you have any questions or comments about this advisory: • Open an issue in awslabs/sockeye • Email us at sockeye-dev Attribution This vulnerability was reported by Masatoshi Yoshizawa of yamory Security Team.

Related

Alias · CVE (1)

  • CVE-2021-43811 Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References