PYSEC-2014-25

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/django-tastypie/PYSEC-2014-25.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2014-25
Aliases
Published
2014-10-27T01:55:00Z
Modified
2024-01-12T21:11:20.972867Z
Summary
[none]
Details

The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

References

Affected packages

PyPI / django-tastypie

Package

Name
django-tastypie
View open source insights on deps.dev
Purl
pkg:pypi/django-tastypie

Affected ranges

Type
GIT
Repo
https://github.com/toastdriven/django-tastypie
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8af315211b07c8f48f32a063233cc3f76dd5bc2
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.10

Affected versions

0.*
0.9.6
0.9.7
0.9.9

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/django-tastypie/PYSEC-2014-25.yaml"