GitHub Advisoryadvisory · PyPI

GHSA-m87f-9fvv-2mgg Deserialization of Untrusted Data in parlai

MEDIUM Published 2021-09-13 Modified 2024-10-09 Official page ↗

Aliases: CVE-2021-39207
Ecosystem: PyPI
Packages: parlai
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Weaknesses: CWE-502
Reviewed: 2021-09-13

Affected packages

• PyPI parlai: < 1.1.0 → fixed in 1.1.0

Description

Impact Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. Patches The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls. References • https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725 • https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879 • https://anon-artist.github.io/blogs/blog3.html

Related

Alias · CVE (1)

CVE-2021-39207 parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. vulnerability

Weakness · CWE (1)

CWE-502 Deserialization of Untrusted Data weakness

References