CVE-2011-4103 Django-piston and Django-tastypie do not properly deserialize YAML data
Remote attackers can execute arbitrary Python code via unsafe YAML deserialization in the Django Piston library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-4103?
CVE-2011-4103 is a high-severity unsafe deserialization vulnerability in n/a, published on 27 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Weakness: CWE-20
Which versions are affected by CVE-2011-4103?
3 open source packages ship an affected version, including django-piston. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
django-piston PyPI | All versions | 0.2.3 |
django-piston PyPI | From 0.2.0 | 0.2.2.1 |
django-piston PyPI | From 0.2.0 | 0.2.2.1 |
Products include Djangoproject Piston.
How do I fix CVE-2011-4103?
Upgrade django-piston to a fixed version for your release line: 0.2.3 or 0.2.2.1.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2011-4103 being exploited?
There is no known exploitation of CVE-2011-4103 in the wild and no public exploit code.
Sources
Also known as DSA-2344-1, GHSA-pvhp-v9qp-xf5r, PYSEC-2014-24.