PT-2014-2163 · Django · Django Tastypie

Daveyss · Publicado 2014-10-27 · Atualizado 2022-05-14 · CVE-2011-4104

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django Tastypie versions prior to 0.9.10

Description The issue concerns the improper deserialization of YAML data by the from yaml method in serializers.py, allowing remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

Recommendations For versions prior to 0.9.10, update to version 0.9.10 or later to resolve the issue. As a temporary workaround, consider disabling the from yaml method until a patch is available. Restrict access to the yaml.load method to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

RCE

Enumeração de Fraquezas

CWE-502

CWE-20

Identificadores relacionados

CVE-2011-4104

GHSA-QGVW-QC2Q-GV5Q

PYSEC-2014-25

Produtos afetados

Django Tastypie

Referências · 14

• https://github.com/pypa/advisory-database/tree/main/vulns/django-tastypie/PYSEC-2014-25.yaml · Nota
• https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2 · Correção
• https://github.com/toastdriven/django-tastypie · Nota
• https://osv.dev/vulnerability/CVE-2011-4104 · Aviso do Fabricante
• https://djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qgvw-qc2q-gv5q · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/11/02/1 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-4104 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4104 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/11/02/7 · Nota
• https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI · Nota
• https://osv.dev/vulnerability/PYSEC-2014-25 · Aviso do Fabricante
• https://groups.google.com/forum/#!topic/django-tastypie/i2aNGDHTUBI · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-4104 · Aviso do Fabricante