Deserialization of Untrusted Data in parlai
CVE-2021-39207

8.4HIGH

Key Information:

Vendor

Facebookresearch

Status
Parlai
Vendor
CVE Published:
10 September 2021

What is CVE-2021-39207?

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.

Affected Version(s)

ParlAI < 1.1.0

References

https://github.com/facebookresearch/ParlAI/security/advis...
x_refsource_CONFIRM
https://github.com/facebookresearch/ParlAI/commit/4374fa2...
x_refsource_MISC
https://github.com/facebookresearch/ParlAI/commit/507d066...
x_refsource_MISC

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.