medium6.6
CVE-2021-23338
qlib Deserialization of Untrusted Data vulnerability
Impact
This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pyqlib | < 0.7.0 | 0.7.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Qlib | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/418sec/huntr/pull/1329
- https://snyk.io/vuln/SNYK-PYTHON-QLIB-1054635
- https://github.com/advisories/GHSA-hjr4-fhgp-23g9
- https://nvd.nist.gov/vuln/detail/CVE-2021-23338
- https://security.snyk.io/vuln/SNYK-PYTHON-PYQLIB-1085990
- https://github.com/pypa/advisory-database/tree/main/vulns/pyqlib/PYSEC-2021-86.yaml