PT-2021-22459 · Parlai · Parlai

Published 2021-09-10 · Updated 2021-09-23 · CVE-2021-39207

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ParlAI versions prior to v1.1.0

Description The issue is caused by unsafe YAML deserialization logic, which allows an attacker with the ability to modify local YAML configuration files to provide malicious input, resulting in remote code execution or similar risks. This is due to the package being vulnerable to a YAML deserialization attack caused by unsafe loading, leading to arbitrary code execution.

Recommendations For versions prior to v1.1.0, update to version v1.1.0 or later to patch the issue. As a temporary workaround for versions where upgrading is not possible, change the Loader used to SafeLoader to avoid unsafe loading. Replace YAML deserialization with equivalent safe load calls to patch the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-39207

GHSA-M87F-9FVV-2MGG

GHSA-MWGJ-7X7J-6966

PYSEC-2021-330

PYSEC-2021-334

Affected Products

Parlai

References · 19

• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg · Patch
• https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725 · Patch
• https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-24040 · Security Note
• https://osv.dev/vulnerability/GHSA-mwgj-7x7j-6966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39207 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39207 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-330 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m87f-9fvv-2mgg · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-334 · Vendor Advisory
• https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0 · Note
• https://github.com/facebookresearch/ParlAI/pull/3402 · Note
• https://github.com/facebookresearch/ParlAI · Note
• https://github.com/facebookresearch/ParlAI/pull/3429 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-334.yaml · Note