Unscored severity · published Oct 27, 2014
CVE-2011-4103
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via…
–
CVSS
2.4%
EPSS
No
On KEV
Description
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Piston · Djangoproject
through 0.2.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4103
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4103
www.debian.org
http://www.debian.org/security/2011/dsa-2344
www.openwall.com
http://www.openwall.com/lists/oss-security/2011/11/01/10
Patch
https://bitbucket.org/jespern/django-piston/commits/91bdaec89543/
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=750658
Vendor Advisory
https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/