CVE-2011-4103
2 advisories.
PyPI/django-piston CVE-2011-4103: critical 9.8
Django-piston and Django-tastypie do not properly deserialize YAML data
Action: Upgrade django-piston to 0.2.2.1 or later.
pip install django-piston==0.2.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.2.0 | 0.2.2.1 | - |
Fixed versions
| 0.2.2.1 |
Sources
- osv: GHSA-pvhp-v9qp-xf5r
- https://nvd.nist.gov/vuln/detail/CVE-2011-4103
- https://bitbucket.org/jespern/django-piston
- https://bitbucket.org/jespern/django-piston/commits/91bdaec89543
- https://bugzilla.redhat.com/show_bug.cgi?id=750658
- https://github.com/advisories/GHSA-pvhp-v9qp-xf5r
- https://github.com/pypa/advisory-database/tree/main/vulns/django-piston/PYSEC-2014-24.yaml
- https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases
- http://www.debian.org/security/2011/dsa-2344
- http://www.openwall.com/lists/oss-security/2011/11/01/10
CVE-2011-4103 · published · modified · JSON
PyPI/django-piston CVE-2011-4103: unknown
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the ya
Action: Upgrade django-piston to 0.2.3 or later.
pip install django-piston==0.2.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.2.3 | - |
Fixed versions
| 0.2.3 |
Sources
- osv: PYSEC-2014-24
- https://bugzilla.redhat.com/show_bug.cgi?id=750658
- http://www.openwall.com/lists/oss-security/2011/11/01/10
- https://bitbucket.org/jespern/django-piston/commits/91bdaec89543/
- http://www.debian.org/security/2011/dsa-2344
- https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/
- https://github.com/advisories/GHSA-pvhp-v9qp-xf5r
CVE-2011-4103 · published · modified · JSON