CVE-2011-4104

EUVD-2014-0006
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Affected Products (NVD)
VendorProductVersion
djangoprojecttastypie
𝑥
≤ 0.9.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
django-tastypie
bookworm
0.13.3-1.1
fixed
bullseye
0.13.3-1.1
fixed
sid
0.13.3-1.1
fixed
trixie
0.13.3-1.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
django-tastypie
hardy
dne
lucid
dne
maverick
dne
natty
dne
oneiric
dne
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2011/11/02/1
http://www.openwall.com/lists/oss-security/2011/11/02/7
https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2
https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI
https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/
http://www.openwall.com/lists/oss-security/2011/11/02/1
http://www.openwall.com/lists/oss-security/2011/11/02/7
https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2
https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI
https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/