A flaw in Piston, a popular REST API framework for Django, was reported [1] in how it handles de-serialization of YAML post data. It uses the yaml.load method, which is unsafe and in certain circumstances could be used to allow remote execution of arbitrary code. The updated versions of Piston (0.2.3 and 0.2.2.1) correctly use the yaml.safeload method which prevents remote code execution.

This does not affect Django itself, but any users who have installed and use the django-piston package on Fedora may be vulnerable.

The upstream patch [2] is in git.

[1] https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/ [2] https://bitbucket.org/jespern/django-piston/changeset/91bdaec89543