id: PYSEC-2018-75
details: 'OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization
  vulnerability in the insecure yaml.load-Function as used in the following files:
  config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command
  is affected by this bug. that can result in Remote Code Execution(even as root if
  suricata-update is called by root). This attack appears to be exploitable via a
  specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml.
  This vulnerability appears to have been fixed in 1.0.0b1.'
affected:
- package:
    name: suricata-update
    ecosystem: PyPI
    purl: pkg:pypi/suricata-update
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.0.0b1
  versions:
  - 1.0.0a1
references:
- type: WEB
  url: https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update
- type: WEB
  url: https://redmine.openinfosecfoundation.org/issues/2359
- type: ADVISORY
  url: https://github.com/advisories/GHSA-7c4h-w765-6pwg
aliases:
- CVE-2018-1000167
- GHSA-7c4h-w765-6pwg
modified: "2021-08-25T04:30:32.993759Z"
published: "2018-04-18T19:29:00Z"