CVE-2021-24040
HIGH8.4EPSS 36.2%Deserialization of Untrusted Data in parlai
發布日:2021/9/13修改日:2026/3/13
描述
### Impact Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. ### Patches The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls. ### References - https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725 - https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879 - https://anon-artist.github.io/blogs/blog3.html
受影響套件(4)
- PyPI/parlaifrom 0, < 1.1.0
- PyPI/parlaifrom 0, < 1.1.0
- PyPI/parlaifrom 0, < 1.1.0
- PyPI/parlaifrom 0, < 507d066ef432ea27d3e201da08009872a2f37725, < 4374fa2aba383db6526ab36e939eb1cf8ef99879 | from 0, < 1.1.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L |
| osv | CVSS 3.1 | HIGH8.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L |
參考連結(13)
- ADVISORYhttps://github.com/advisories/GHSA-mwgj-7x7j-6966
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-24040
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-39207
- PATCHhttps://github.com/facebookresearch/ParlAI
- WEBhttp://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
- WEBhttps://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
- WEBhttps://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
- WEBhttps://github.com/facebookresearch/ParlAI/pull/3402
- WEBhttps://github.com/facebookresearch/ParlAI/pull/3429
- WEBhttps://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
- WEBhttps://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-330.yaml
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-334.yaml