critical9.8
CVE-2011-4103
Django-piston and Django-tastypie do not properly deserialize YAML data
Impact
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. Django Tastypie has a very similar vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | django-piston | >= 0.2.0, < 0.2.2.1 | 0.2.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Djangoproject | Piston | through 0.2.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.debian.org/security/2011/dsa-2344
- http://www.openwall.com/lists/oss-security/2011/11/01/10
- https://bitbucket.org/jespern/django-piston/commits/91bdaec89543/
- https://bugzilla.redhat.com/show_bug.cgi?id=750658
- https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/
- https://github.com/advisories/GHSA-pvhp-v9qp-xf5r
- https://nvd.nist.gov/vuln/detail/CVE-2011-4103
- https://bitbucket.org/jespern/django-piston/commits/91bdaec89543
- https://github.com/pypa/advisory-database/tree/main/vulns/django-piston/PYSEC-2014-24.yaml
- https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases