PT-2018-13935 · Marshmallow Library+2 · Marshmallow+2

Ye · Published 2018-09-18 · Updated 2026-04-30 · CVE-2018-17175

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions marshmallow library versions prior to 2.15.1 marshmallow library versions 3.x prior to 3.0.0b9

Description The issue arises from the schema "only" option in the marshmallow library, where an empty list is treated as if no "only" option was specified. This can lead to a request exposing all fields instead of none, under specific conditions involving dynamic filtering of the schema and user roles that produce empty values for the "only" option.

Recommendations For versions prior to 2.15.1, update to version 2.15.1 or later to resolve the issue. For versions 3.x prior to 3.0.0b9, update to version 3.0.0b9 or later to resolve the issue.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2018-17175

GHSA-9Q2P-FJ49-VPXJ

MGASA-2019-0065

OPENSUSE-SU-2024:11238-1

OPENSUSE-SU-2024:14147-1

PYSEC-2018-67

USN-8225-1

Affected Products

Linuxmint

Ubuntu

Marshmallow

References · 24

• https://osv.dev/vulnerability/openSUSE-SU-2024:14147-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8225-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68480 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17175 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17175 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0065 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8225-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0065.html · Security Note
• https://osv.dev/vulnerability/GHSA-9q2p-fj49-vpxj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17175 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17175 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-17175 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/GCKZAADQI7JJ3ZUN7DSIR2JH3VZEJZDM · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-67 · Vendor Advisory