PT-2014-2162 · Django · Django Tastypie+1

Published 2014-10-27 · Updated 2018-07-23 · CVE-2011-4103

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django Piston versions prior to 0.2.3 Django Piston versions 0.2.x prior to 0.2.2.1

Description The issue is related to the improper deserialization of YAML data in the emitters.py file, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. A similar vulnerability exists in Django Tastypie.

Recommendations For Django Piston versions prior to 0.2.3, update to version 0.2.3 or later. For Django Piston versions 0.2.x prior to 0.2.2.1, update to version 0.2.2.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-4103

DSA-2344-1

GHSA-PVHP-V9QP-XF5R

PYSEC-2014-24

Affected Products

Django Piston

Django Tastypie

References · 11

• http://debian.org/security/2011/dsa-2344 · Vendor Advisory
• https://djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4103 · Security Note
• https://bitbucket.org/jespern/django-piston/commits/91bdaec89543 · Patch
• https://osv.dev/vulnerability/PYSEC-2014-24 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pvhp-v9qp-xf5r · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/django-piston/PYSEC-2014-24.yaml · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=750658 · Note
• https://bitbucket.org/jespern/django-piston · Note
• http://openwall.com/lists/oss-security/2011/11/01/10 · Note
• https://github.com/advisories/GHSA-pvhp-v9qp-xf5r · Note