CVE-2021-41078: Arbitrary Code Execution in nameko
Summary
CVE-2021-41078: Nameko Arbitrary code execution due to YAML deserialization. Affects nameko across 2 version ranges.
< 2.14.0
>= 3.0.0rc0, < 3.0.0rc10
Fixed in 2.14.0 or 3.0.0rc10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nameko is an open-source Python framework for building microservices. It provides a simple and flexible way to develop distributed systems. The framework allows developers to easily define and deploy microservices, which can communicate with each other using messaging patterns. nameko is widely used in various applications and has a large user base. However, a vulnerability has been discovered in nameko that allows for arbitrary code execution when deserializing a YAML config file.
Vulnerability Detail
The vulnerability in nameko arises from the deserialization of YAML config files. An attacker can craft a malicious YAML file that exploits the deserialization process to execute arbitrary code. By injecting specially crafted YAML content, an attacker can trick nameko into executing arbitrary commands on the system. This can lead to various security issues, including unauthorized access, data leakage, and remote code execution. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.14.02.14.0pip install --upgrade "nameko==2.14.0" -
>= 3.0.0rc0, < 3.0.0rc103.0.0rc10pip install --upgrade "nameko==3.0.0rc10"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using config files with untrusted content. By only using config files from trusted sources, the risk of exploitation can be mitigated. It is important to carefully review and validate the content of config files before using them with nameko.
Conclusion
The vulnerability in nameko that allows for arbitrary code execution when deserializing YAML config files can have severe consequences, including unauthorized access and remote code execution. It is crucial to update nameko to version 2.14.0 or later to mitigate this vulnerability. Additionally, users should exercise caution when using config files and only trust content from reliable sources. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nameko →
FAQ
nameko is an open-source Python framework for building microservices. It provides a simple and flexible way to develop distributed systems.
The vulnerability allows for arbitrary code execution in nameko, which can lead to unauthorized access, data leakage, and remote code execution.
To fix this vulnerability, update nameko to version 2.14.0 or later using the command 'pip install --upgrade nameko'.
Yes, users can avoid using config files with untrusted content to mitigate the risk of exploitation.
You can find more information about this vulnerability in the official advisory from the GitHub Security Advisory Database.
