9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.006 Low
EPSS
Percentile
77.5%
Riccardo Schirone (https://github.com/ret2libc) reports:
In FullLoader python/object/new constructor, implemented by
construct_python_object_apply, has support for setting the
state of a deserialized instance through the set_python_instance_state
method. After setting the state, some operations are performed
on the instance to complete its initialization, however it is
possible for an attacker to set the instance’ state in such a way
that arbitrary code is executed by the FullLoader.
This patch tries to block such attacks in FullLoader by
preventing set_python_instance_state from setting arbitrar
properties. It implements a blacklist that includes extend method
(called by construct_python_object_apply) and all special
methods (e.g. set, setitem, etc.).
Users who need special attributes being set in the state of a
deserialized object can still do it through the UnsafeLoader, which
however should not be used on untrusted input. Additionally, they can
subclass FullLoader and redefine state_blacklist_regexp to include the
additional attributes they need, passing the subclassed loader to
yaml.load.
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.006 Low
EPSS
Percentile
77.5%