GitHub Advisoryadvisory · PyPI

GHSA-j28r-j54m-gpc4 Code Injection in SLO Generator

MEDIUM Published 2021-10-05 Modified 2024-10-22 Official page ↗
Aliases
CVE-2021-22557
Ecosystem
PyPI
Packages
slo-generator
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-78, CWE-94
Reviewed
2021-10-05

Affected packages

• PyPI slo-generator: < 2.0.1 → fixed in 2.0.1

Description

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173

Related

Alias · CVE (1)

  • CVE-2021-22557 SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the… vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-94 Improper Control of Generation of Code weakness

References