Remote Code Execution (RCE)

ansible-vault is vulnerable to remote code execution RCE attacks. The application uses the unsafe yaml.load method to deserialize YAML files, allowing a malicious user to inject and execute arbitrary python code...

Python Ansible Vault Package Remote Code Execution Vulnerability

Ansible Vault is a management tool for vam yaml files. A security vulnerability exists in the yaml loading feature in Ansible Vault versions prior to 1.0.5. An attacker can exploit this vulnerability to execute arbitrary commands by executing python commands...

PYSEC-2017-5

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

Input validation

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

CVE-2017-2809

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

CVE-2017-2809

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

PYSEC-2017-5

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

CVE-2017-2809

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

CVE-2017-2809

CVE-2017-2809 describes a YAML loading vulnerability in Ansible Vault prior to 1.0.5. A specially crafted vault can trigger arbitrary Python command execution, enabling code execution on affected systems. The issue affects the yaml loading functionality in ansible-vault, with the root cause tied ...

Vulnerability Spotlight: YAML Parsing Remote Code Execution Vulnerabilities in Ansible Vault and Tablib

Vulnerabilities discovered by Cory Duplantis of Talos.Talos is disclosing the presences of remote code execution vulnerabilities in the processing of Yet Another Markup Language YAML content in Ansible Vault and Tablib. Attackers can exploit these vulnerabilities through supplying malicious YAML...

ansible-vault Yaml Load Code Execution Vulnerability

Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...

Default configuration

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...

CVE-2016-8744

CVE-2016-8744 affects Apache Brooklyn. The issue stems from SnakeYAML: in Brooklyn’s default configuration prior to 0.10.0, unmarshal allows any Java type on the classpath. This enables an authenticated user to cause the JVM running Brooklyn to load and execute Java code with the process’s privil...

GLSA-201709-01 : MCollective: Remote Code Execution

The remote host is affected by the vulnerability described in GLSA-201709-01 MCollective: Remote Code Execution A vulnerability was discovered in MCollective which allowed for deserialized YAML from agents without calling safeload. This allows the potential for arbitrary code execution on the...

MCollective: Remote Code Execution

Background MCollective is a framework to build server orchestration or parallel job execution systems. Description A vulnerability was discovered in MCollective which allowed for deserialized YAML from agents without calling safeload. This allows the potential for arbitrary code execution on the...

Fedora 25 : python-tablib (2017-fe04b06b64)

Latest upstream, including the yaml.safeload fix for CVE-2017-2810. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 25 Update: python-tablib-0.11.5-1.fc25

Tablib is a format-agnostic tabular dataset library, written in Python. Output formats supported: - Excel Sets + Books - JSON Sets + Books - YAML Sets + Books - HTML Sets - TSV Sets - CSV Sets...

[SECURITY] Fedora 26 Update: python-tablib-0.11.5-1.fc26

Tablib is a format-agnostic tabular dataset library, written in Python. Output formats supported: - Excel Sets + Books - JSON Sets + Books - YAML Sets + Books - HTML Sets - TSV Sets - CSV Sets...

SUSE SLED12 Security Update : puppet (SUSE-SU-2017:2113-1)

This update for puppet fixes the following issues: Security issue fixed : - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as...

SUSE-SU-2017:2113-1 Security update for puppet

This update for puppet fixes the following issues: Security issue fixed: - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as t...