Unscored severity · published Oct 27, 2014
CVE-2011-4104
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via…
–
CVSS
2.4%
EPSS
No
On KEV
Description
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Tastypie · Djangoproject
through 0.9.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4104
Patch
http://www.openwall.com/lists/oss-security/2011/11/02/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2011/11/02/7
Patch
https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2
groups.google.com
https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI
Vendor Advisory
https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/