4312 matches found
PYSEC-2017-5
An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...
PYSEC-2017-5
An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...
CVE-2017-2809
An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...
CVE-2017-2809
CVE-2017-2809 describes a YAML loading vulnerability in Ansible Vault prior to 1.0.5. A specially crafted vault can trigger arbitrary Python command execution, enabling code execution on affected systems. The issue affects the yaml loading functionality in ansible-vault, with the root cause tied ...
CVE-2017-2809
An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...
Vulnerability Spotlight: YAML Parsing Remote Code Execution Vulnerabilities in Ansible Vault and Tablib
Vulnerabilities discovered by Cory Duplantis of Talos.Talos is disclosing the presences of remote code execution vulnerabilities in the processing of Yet Another Markup Language YAML content in Ansible Vault and Tablib. Attackers can exploit these vulnerabilities through supplying malicious YAML...
ansible-vault Yaml Load Code Execution Vulnerability
Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...
Default configuration
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
CVE-2016-8744
CVE-2016-8744 affects Apache Brooklyn. The issue stems from SnakeYAML: in Brooklyn’s default configuration prior to 0.10.0, unmarshal allows any Java type on the classpath. This enables an authenticated user to cause the JVM running Brooklyn to load and execute Java code with the process’s privil...
GLSA-201709-01 : MCollective: Remote Code Execution
The remote host is affected by the vulnerability described in GLSA-201709-01 MCollective: Remote Code Execution A vulnerability was discovered in MCollective which allowed for deserialized YAML from agents without calling safeload. This allows the potential for arbitrary code execution on the...
MCollective: Remote Code Execution
Background MCollective is a framework to build server orchestration or parallel job execution systems. Description A vulnerability was discovered in MCollective which allowed for deserialized YAML from agents without calling safeload. This allows the potential for arbitrary code execution on the...
Fedora 25 : python-tablib (2017-fe04b06b64)
Latest upstream, including the yaml.safeload fix for CVE-2017-2810. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...
[SECURITY] Fedora 25 Update: python-tablib-0.11.5-1.fc25
Tablib is a format-agnostic tabular dataset library, written in Python. Output formats supported: - Excel Sets + Books - JSON Sets + Books - YAML Sets + Books - HTML Sets - TSV Sets - CSV Sets...
[SECURITY] Fedora 26 Update: python-tablib-0.11.5-1.fc26
Tablib is a format-agnostic tabular dataset library, written in Python. Output formats supported: - Excel Sets + Books - JSON Sets + Books - YAML Sets + Books - HTML Sets - TSV Sets - CSV Sets...
SUSE SLED12 Security Update : puppet (SUSE-SU-2017:2113-1)
This update for puppet fixes the following issues: Security issue fixed : - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as...
SUSE-SU-2017:2113-1 Security update for puppet
This update for puppet fixes the following issues: Security issue fixed: - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as t...
SUSE-SU-2017:2105-1 Security update for python-tablib
This update for python-tablib fixes the following issues: - CVE-2017-2810: Use yaml.safeload and yaml.safedump to avoid executing code when importing data bsc1044329...
CVE-2017-11692
The function "Token& Scanner::peek" in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service assertion failure and application exit via a '!2' string...
Denial Of Service (DoS)
Yaml-cpp is vulnerable to denial of service DoS attacks. The Token& Scanner::peek function in scanner.cpp may cause an assertion failure and application exit through a !2 string...