PyPI/parlai CVE-2021-24040, CVE-2021-39207: medium, EPSS 17.35%

Deserialization of Untrusted Data in ParlAI

Action: Upgrade parlai to 1.1.0 or later.

pip install parlai==1.1.0

Affected

Fixed versions

Sources

• osv: GHSA-mwgj-7x7j-6966
• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
• https://nvd.nist.gov/vuln/detail/CVE-2021-24040
• https://github.com/facebookresearch/ParlAI/pull/3402
• https://github.com/facebookresearch/ParlAI/pull/3429
• https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
• https://github.com/facebookresearch/ParlAI
• https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
• http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html

CVE-2021-24040, CVE-2021-39207 · published 2021-09-13T20:06:14Z · modified 2024-12-04T05:39:38.595706Z · JSON