EUVD-2021-0470

Malware in sbrugna...

CVE-2021-38305

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

Code Execution Bug Affects Yamale Python Package — Used by Over 200 Projects

A high-severity code injection vulnerability has been disclosed in 23andMe's Yamale, a schema and validator for YAML, that could be trivially exploited by adversaries to execute arbitrary Python code. The flaw, tracked as CVE-2021-38305 CVSS score: 7.8, involves manipulating the schema file...

flex-gw-api-automation (>=0.1.0, <=0.1.7) potentially affected by CVE-2021-38305 via yamale (1.10.1)

yamale PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on yamale and may be impacted: - flex-gw-api-automation =0.1.0, =0.1.7 Source cves: CVE-2021-38305 Source advisory: OSV:GHSA-435P-F82X-MXWM...

linky-db (>=1.0.0, <=1.5.0) potentially affected by CVE-2021-38305 via yamale (2.0.1)

yamale PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on yamale and may be impacted: - linky-db =1.0.0, =1.5.0 Source cves: CVE-2021-38305 Source advisory: OSV:GHSA-435P-F82X-MXWM...

esmvalcore (>=2.0.0, <=2.2.0), esque (>=0.2.0b1, <=0.3.1) +3 more potentially affected by CVE-2021-38305 via yamale (2.2.0)

yamale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on yamale and may be impacted: - esmvalcore =2.0.0, =0.2.0b1, =0.0.1.dev3092, =0.1.0b0, =0.1.0b6 Source cves: CVE-2021-38305 Source advisory: OSV:GHSA-435P-F82X-MXWM...

ingenii-azure-data-platform (>=0.0.2, <=0.0.5), python-fx (0.1.0b2.post1) potentially affected by CVE-2021-38305 via yamale (>=3.0.6, <=3.0.7)

yamale PYPI version =3.0.6, =0.0.2, =0.0.5 - python-fx 0.1.0b2.post1 Source cves: CVE-2021-38305 Source advisory: OSV:GHSA-435P-F82X-MXWM...

ingenii-azure-data-platform (>=0.0.2, <=0.0.5), python-fx (0.1.0b2.post1) potentially affected by CVE-2021-38305 via yamale (>=3.0.6, <=3.0.7)

yamale PYPI version =3.0.6, =0.0.2, =0.0.5 - python-fx 0.1.0b2.post1 Source cves: CVE-2021-38305 Source advisory: GHSA-435P-F82X-MXWM...

Command injection in Yamale

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

GHSA-435P-F82X-MXWM Command injection in Yamale

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

CVE-2021-38305

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

CVE-2021-38305

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

PYSEC-2021-119

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

flex-gw-api-automation (>=0.1.0, <=0.1.7) potentially affected by CVE-2021-38305 via yamale (1.10.1)

yamale PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on yamale and may be impacted: - flex-gw-api-automation =0.1.0, =0.1.7 Source cves: CVE-2021-38305 Source advisory: OSV:PYSEC-2021-119...

linky-db (>=1.0.0, <=1.5.0) potentially affected by CVE-2021-38305 via yamale (2.0.1)

yamale PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on yamale and may be impacted: - linky-db =1.0.0, =1.5.0 Source cves: CVE-2021-38305 Source advisory: OSV:PYSEC-2021-119...

esmvalcore (>=2.0.0, <=2.2.0), esque (>=0.2.0b1, <=0.3.1) +3 more potentially affected by CVE-2021-38305 via yamale (2.2.0)

yamale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on yamale and may be impacted: - esmvalcore =2.0.0, =0.2.0b1, =0.0.1.dev3092, =0.1.0b0, =0.1.0b6 Source cves: CVE-2021-38305 Source advisory: OSV:PYSEC-2021-119...

ingenii-azure-data-platform (>=0.0.2, <=0.0.5), python-fx (0.1.0b2.post1) potentially affected by CVE-2021-38305 via yamale (>=3.0.6, <=3.0.7)

yamale PYPI version =3.0.6, =0.0.2, =0.0.5 - python-fx 0.1.0b2.post1 Source cves: CVE-2021-38305 Source advisory: OSV:PYSEC-2021-119...

PYSEC-2021-119

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

CVE-2021-38305

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...

CVE-2021-38305

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each li...