Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for tastypie by djangoproject

    CVE-2011-4104 (GCVE-0-2011-4104)

    Vulnerability from nvd – Published: 2014-10-27 01:00 – Updated: 2024-08-07 00:01
    VLAI
    Summary
    The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    Date Public
    2011-11-01 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:01:49.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI"
          },
          {
            "name": "[oss-security] 20111102 Re: Re: CVE request for Django-piston and Tastypie",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/11/02/7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2"
          },
          {
            "name": "[oss-security] 20111102 Re: CVE request for Django-piston and Tastypie",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/11/02/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-11-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-27T00:57:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI"
        },
        {
          "name": "[oss-security] 20111102 Re: Re: CVE request for Django-piston and Tastypie",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/11/02/7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2"
        },
        {
          "name": "[oss-security] 20111102 Re: CVE request for Django-piston and Tastypie",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/11/02/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-4104",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!topic/django-tastypie/i2aNGDHTUBI",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/django-tastypie/i2aNGDHTUBI"
            },
            {
              "name": "[oss-security] 20111102 Re: Re: CVE request for Django-piston and Tastypie",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/11/02/7"
            },
            {
              "name": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/",
              "refsource": "MISC",
              "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/"
            },
            {
              "name": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2",
              "refsource": "CONFIRM",
              "url": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2"
            },
            {
              "name": "[oss-security] 20111102 Re: CVE request for Django-piston and Tastypie",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/11/02/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-4104",
    "datePublished": "2014-10-27T01:00:00.000Z",
    "dateReserved": "2011-10-18T00:00:00.000Z",
    "dateUpdated": "2024-08-07T00:01:49.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2011-4104 (GCVE-0-2011-4104)

    Vulnerability from cvelistv5 – Published: 2014-10-27 01:00 – Updated: 2024-08-07 00:01
    VLAI
    Summary
    The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    Date Public
    2011-11-01 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:01:49.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI"
          },
          {
            "name": "[oss-security] 20111102 Re: Re: CVE request for Django-piston and Tastypie",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/11/02/7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2"
          },
          {
            "name": "[oss-security] 20111102 Re: CVE request for Django-piston and Tastypie",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/11/02/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-11-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-27T00:57:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/django-tastypie/i2aNGDHTUBI"
        },
        {
          "name": "[oss-security] 20111102 Re: Re: CVE request for Django-piston and Tastypie",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/11/02/7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2"
        },
        {
          "name": "[oss-security] 20111102 Re: CVE request for Django-piston and Tastypie",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/11/02/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-4104",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!topic/django-tastypie/i2aNGDHTUBI",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/django-tastypie/i2aNGDHTUBI"
            },
            {
              "name": "[oss-security] 20111102 Re: Re: CVE request for Django-piston and Tastypie",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/11/02/7"
            },
            {
              "name": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/",
              "refsource": "MISC",
              "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/"
            },
            {
              "name": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2",
              "refsource": "CONFIRM",
              "url": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2"
            },
            {
              "name": "[oss-security] 20111102 Re: CVE request for Django-piston and Tastypie",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/11/02/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-4104",
    "datePublished": "2014-10-27T01:00:00.000Z",
    "dateReserved": "2011-10-18T00:00:00.000Z",
    "dateUpdated": "2024-08-07T00:01:49.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}