PT-2017-14496 · Mlalchemy · Mlalchemy

Joel · Published 2017-11-08 · Updated 2019-10-03 · CVE-2017-16615

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MLAlchemy versions prior to 0.2.2

Description A vulnerability exists in the YAML parsing functionality. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands, resulting in command execution. This occurs because the load function is used where safe load should have been used. An attacker can insert Python into loaded YAML to trigger this issue.

Recommendations For versions prior to 0.2.2, update to version 0.2.2 or later to resolve the issue. As a temporary workaround, consider modifying the parse yaml query method in parser.py to use safe load instead of load to prevent arbitrary command execution.

Fix

Related Identifiers

CVE-2017-16615

GHSA-XPM8-98MX-H4C5

PYSEC-2017-19

Affected Products

Mlalchemy

References · 10

• https://osv.dev/vulnerability/CVE-2017-16615 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xpm8-98mx-h4c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16615 · Security Note
• https://osv.dev/vulnerability/PYSEC-2017-19 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/mlalchemy/PYSEC-2017-19.yaml · Note
• https://github.com/thanethomson/MLAlchemy/commit/bc795757febdcce430d89f9d08f75c32d6989d3c · Note
• https://github.com/thanethomson/MLAlchemy/issues/1 · Note
• https://github.com/thanethomson/MLAlchemy · Note
• https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16615-critical-restful-web-applications-vulnerability · Note
• https://github.com/advisories/GHSA-xpm8-98mx-h4c5 · Note