id: PYSEC-2021-383
details: Nameko through 2.13.0 can be tricked into performing arbitrary code execution
  when deserializing the config file.
affected:
- package:
    name: nameko
    ecosystem: PyPI
    purl: pkg:pypi/nameko
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.14.0
  versions:
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.6.0
  - 0.7.0
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.11.1
  - 1.11.2
  - 1.11.3
  - 1.11.4
  - 1.11.5
  - 1.12.0
  - 1.13.0
  - 1.14.0
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.6.0
  - 1.6.1
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.9.0
  - 1.9.1
  - 2.0.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.10.0
  - 2.11.0
  - 2.12.0
  - 2.13.0
  - 2.2.0
  - 2.3.0
  - 2.3.1
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.5.3
  - 2.5.4
  - 2.6.0
  - 2.7.0
  - 2.8.0
  - 2.8.1
  - 2.8.2
  - 2.8.3
  - 2.8.4
  - 2.8.5
  - 2.9.0
  - 2.9.0rc0
  - 2.9.1
  - 2.9.1rc0
references:
- type: ADVISORY
  url: https://github.com/nameko/nameko/security/advisories/GHSA-6p52-jr3q-c94g
- type: WEB
  url: https://github.com/nameko/nameko
aliases:
- CVE-2021-41078
- GHSA-6p52-jr3q-c94g
modified: "2021-10-29T05:27:28.492888Z"
published: "2021-10-26T13:15:00Z"