CVE-2017-16615 Unsafe deserialization in MLAlchemy
CriticalCVSS 9.8
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi mlalchemy(PyPI) | < 0.2.2 | 0.2.2 |
| pypi mlalchemy(PyPI) | = 0.1.0 | No fix listed |
| pypi mlalchemy(PyPI) | = 0.1.1 | No fix listed |
| pypi mlalchemy(PyPI) | = 0.1.2 | No fix listed |
| pypi mlalchemy(PyPI) | = 0.1.3 | No fix listed |
| pypi mlalchemy(PyPI) | = 0.2.0 | No fix listed |
| pypi mlalchemy(PyPI) | = 0.2.1 | No fix listed |
| mlalchemy project mlalchemy | = 0.1.1 | No fix listed |
| mlalchemy project mlalchemy | = 0.1.2 | No fix listed |
| mlalchemy project mlalchemy | = 0.1.3 | No fix listed |
| mlalchemy project mlalchemy | = 0.2.0 | No fix listed |
| mlalchemy project mlalchemy | = 0.2.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking
- github.com issue-tracking patch
- github.com
- github.com product
- joel-malwarebenchmark.github.io technical-description third-party-advisory
- github.com vendor-advisory