CVE-2011-4103: Input Validation
A flaw in Piston, a popular REST API framework for Django, was reported [1] in how it handles de-serialization of YAML post data. It uses the yaml.load method, which is unsafe and in certain circumstances could be used to allow remote execution of arbitrary code. The updated versions of Piston (0.2.3 and 0.2.2.1) correctly use the yaml.safeload method which prevents remote code execution.
This does not affect Django itself, but any users who have installed and use the django-piston package on Fedora may be vulnerable.
The upstream patch [2] is in git.
[1] https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/ [2] https://bitbucket.org/jespern/django-piston/changeset/91bdaec89543
Other sources
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4103?
CVE-2011-4103 is classified as a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2011-4103?
To fix CVE-2011-4103, upgrade to Piston version 0.2.2.1 or later.
What software is affected by CVE-2011-4103?
CVE-2011-4103 affects the Djangoproject Piston API framework versions prior to 0.2.2.1.
Can CVE-2011-4103 lead to attacks on my application?
Yes, CVE-2011-4103 can lead to remote code execution attacks if not mitigated.
How was CVE-2011-4103 discovered?
CVE-2011-4103 was reported due to an unsafe YAML deserialization process in the Piston framework.