id: PYSEC-2014-25
details: The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does
  not properly deserialize YAML data, which allows remote attackers to execute arbitrary
  Python code via vectors related to the yaml.load method.
affected:
- package:
    name: django-tastypie
    ecosystem: PyPI
    purl: pkg:pypi/django-tastypie
  ranges:
  - type: GIT
    repo: https://github.com/toastdriven/django-tastypie
    events:
    - introduced: "0"
    - fixed: e8af315211b07c8f48f32a063233cc3f76dd5bc2
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.9.10
  versions:
  - 0.9.6
  - 0.9.7
  - 0.9.9
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2011/11/02/1
- type: ARTICLE
  url: 
    https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/
- type: FIX
  url: 
    https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2011/11/02/7
- type: WEB
  url: https://groups.google.com/forum/#!topic/django-tastypie/i2aNGDHTUBI
- type: ADVISORY
  url: https://github.com/advisories/GHSA-qgvw-qc2q-gv5q
aliases:
- CVE-2011-4104
- GHSA-qgvw-qc2q-gv5q
modified: "2021-07-25T23:34:28.733002Z"
published: "2014-10-27T01:55:00Z"