PT-2017-14496 · Mlalchemy · Mlalchemy

Joel · Publicado 2017-11-08 · Atualizado 2019-10-03 · CVE-2017-16615

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MLAlchemy versions prior to 0.2.2

Description A vulnerability exists in the YAML parsing functionality. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands, resulting in command execution. This occurs because the load function is used where safe load should have been used. An attacker can insert Python into loaded YAML to trigger this issue.

Recommendations For versions prior to 0.2.2, update to version 0.2.2 or later to resolve the issue. As a temporary workaround, consider modifying the parse yaml query method in parser.py to use safe load instead of load to prevent arbitrary command execution.

Correção

Identificadores relacionados

CVE-2017-16615

GHSA-XPM8-98MX-H4C5

PYSEC-2017-19

Produtos afetados

Mlalchemy

Referências · 10

• https://github.com/pypa/advisory-database/tree/main/vulns/mlalchemy/PYSEC-2017-19.yaml · Nota
• https://github.com/thanethomson/MLAlchemy/commit/bc795757febdcce430d89f9d08f75c32d6989d3c · Nota
• https://github.com/thanethomson/MLAlchemy/issues/1 · Nota
• https://github.com/thanethomson/MLAlchemy · Nota
• https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16615-critical-restful-web-applications-vulnerability · Nota
• https://osv.dev/vulnerability/CVE-2017-16615 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xpm8-98mx-h4c5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16615 · Nota de Segurança
• https://github.com/advisories/GHSA-xpm8-98mx-h4c5 · Nota
• https://osv.dev/vulnerability/PYSEC-2017-19 · Aviso do Fabricante