{"action":"Upgrade suricata-update to 1.0.0b1 or later.","affected":[{"fixed":"1.0.0b1","introduced":"0"}],"component":"suricata-update","cve_ids":["CVE-2018-1000167"],"ecosystem":"PyPI","epss":0.04052,"exploited":false,"fixed_versions":["1.0.0b1"],"ghsa_id":"GHSA-7c4h-w765-6pwg","id":"tcs_01M5KG85W8S60T4YCYQ5Z4CB4T","modified_at":"2026-06-10T17:02:42.638662554Z","published_at":"2018-04-18T19:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-75","https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update","https://redmine.openinfosecfoundation.org/issues/2359","https://github.com/advisories/GHSA-7c4h-w765-6pwg"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2018-75","url":"https://osv.dev/vulnerability/PYSEC-2018-75"},{"source":"nvd","source_id":"CVE-2018-1000167","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000167"}],"summary":"OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 a"}