PyPI/pydrive2 CVE-2023-49297: low 3.3, EPSS 0.51%
PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution
Action: Upgrade pydrive2 to 1.16.2 or later.
pip install pydrive2==1.16.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.16.2 | - |
Fixed versions
| 1.16.2 |
Sources
- osv: GHSA-v5f6-hjmf-9mc5
- https://github.com/iterative/PyDrive2/security/advisories/GHSA-v5f6-hjmf-9mc5
- https://nvd.nist.gov/vuln/detail/CVE-2023-49297
- https://github.com/iterative/PyDrive2/commit/c57355dc2033ad90b7050d681b2c3ba548ff0004
- https://github.com/iterative/PyDrive2
- https://github.com/pypa/advisory-database/tree/main/vulns/pydrive2/PYSEC-2023-291.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYR5SJKOFSSXFV3E3D2SLXBUBA5WMJJG
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K34YWTDKBAYWZPOAKBYDM72WIFL5CAYW
CVE-2023-49297 · published · modified · JSON