Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/yamale@3.0.6
Typepypi
Namespace
Nameyamale
Version3.0.6
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.0.8
Latest_non_vulnerable_version3.0.8
Affected_by_vulnerabilities
0
url VCID-erwm-mscq-9yer
vulnerability_id VCID-erwm-mscq-9yer
summary 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.
references
0
reference_url https://github.com/23andMe/Yamale
reference_id
reference_type
scores
url https://github.com/23andMe/Yamale
1
reference_url https://github.com/23andMe/Yamale/pull/165
reference_id
reference_type
scores
url https://github.com/23andMe/Yamale/pull/165
2
reference_url https://github.com/23andMe/Yamale/releases/tag/3.0.8
reference_id
reference_type
scores
url https://github.com/23andMe/Yamale/releases/tag/3.0.8
3
reference_url https://github.com/advisories/GHSA-435p-f82x-mxwm
reference_id
reference_type
scores
url https://github.com/advisories/GHSA-435p-f82x-mxwm
4
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/yamale/PYSEC-2021-119.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/yamale/PYSEC-2021-119.yaml
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-38305
reference_id CVE-2021-38305
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2021-38305
fixed_packages
0
url pkg:pypi/yamale@3.0.8
purl pkg:pypi/yamale@3.0.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/yamale@3.0.8
aliases CVE-2021-38305, GHSA-435p-f82x-mxwm, PYSEC-2021-119
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-erwm-mscq-9yer
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/yamale@3.0.6