PT-2014-2163 · Django · Django Tastypie

Daveyss · Published 2014-10-27 · Updated 2022-05-14 · CVE-2011-4104

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django Tastypie versions prior to 0.9.10

Description The issue concerns the improper deserialization of YAML data by the from yaml method in serializers.py, allowing remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

Recommendations For versions prior to 0.9.10, update to version 0.9.10 or later to resolve the issue. As a temporary workaround, consider disabling the from yaml method until a patch is available. Restrict access to the yaml.load method to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2011-4104

GHSA-QGVW-QC2Q-GV5Q

PYSEC-2014-25

Affected Products

Django Tastypie

References · 14

• https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2 · Patch
• https://osv.dev/vulnerability/CVE-2011-4104 · Vendor Advisory
• https://djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qgvw-qc2q-gv5q · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/11/02/1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-4104 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4104 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-25 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4104 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/django-tastypie/PYSEC-2014-25.yaml · Note
• https://github.com/toastdriven/django-tastypie · Note
• http://openwall.com/lists/oss-security/2011/11/02/7 · Note
• https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI · Note
• https://groups.google.com/forum/#!topic/django-tastypie/i2aNGDHTUBI · Note