GitHub Advisoryadvisory · PyPI

GHSA-pvhp-v9qp-xf5r Django-piston and Django-tastypie do not properly deserialize YAML data

CRITICAL Published 2018-07-23 Modified 2024-09-16 Official page ↗
Aliases
CVE-2011-4103
Ecosystem
PyPI
Packages
django-piston
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• PyPI django-piston: >= 0.2.0, < 0.2.2.1 → fixed in 0.2.2.1

Description

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. Django Tastypie has a very similar vulnerability.

Related

Alias · CVE (1)

  • CVE-2011-4103 emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References