CVE-2011-4104 Django Tastypie Improper Deserialization of YAML Data
Remote attackers can execute arbitrary Python code via unsafe YAML deserialization in the Django Tastypie library.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-4104?
CVE-2011-4104 is a high-severity unsafe deserialization vulnerability in n/a, published on 27 Oct 2014. It can be exploited over the network, with no action from the victim.
Official description
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Weakness: CWE-20
Which versions are affected by CVE-2011-4104?
3 open source packages ship an affected version, including django-tastypie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
django-tastypie PyPI | All versions | 0.9.10 |
django-tastypie PyPI | All versions | 0.9.10 |
django-tastypie PyPI | All versions | 0.9.10 |
Products include Djangoproject Tastypie.
How do I fix CVE-2011-4104?
Upgrade django-tastypie to 0.9.10 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2011-4104 being exploited?
There is no known exploitation of CVE-2011-4104 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2011-4104, GHSA-qgvw-qc2q-gv5q, PYSEC-2014-25.