CVE-2021-41078 Nameko Arbitrary code execution due to YAML deserialization
Attackers can execute arbitrary code by tricking Nameko into deserializing a malicious configuration file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-41078?
CVE-2021-41078 is a high-severity unsafe deserialization vulnerability in n/a, published on 26 Oct 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.
Weakness: CWE-502
Which versions are affected by CVE-2021-41078?
5 open source packages ship an affected version, including nameko. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nameko PyPI | All versions | 2.14.0 |
nameko PyPI | All versions | 2.14.0 |
nameko PyPI | All versions | 2.14.0 |
nameko PyPI | From 3.0.0rc0 | 3.0.0rc10 |
nameko PyPI | From 3.0.0rc0 | 3.0.0rc10 |
Products include Nameko Nameko.
How do I fix CVE-2021-41078?
Upgrade nameko to a fixed version for your release line: 2.14.0 or 3.0.0rc10.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-41078 being exploited?
There is no known exploitation of CVE-2021-41078 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-6p52-jr3q-c94g, PYSEC-2021-383.