CVE-2021-43811: Code injection via unsafe YAML loading in sockeye
Summary
CVE-2021-43811: Code injection via unsafe YAML loading. Affects sockeye versions < 2.3.24. Fixed in 2.3.24. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sockeye is a package that utilizes YAML to store model and data configurations on disk. It is commonly used for machine learning tasks. However, versions below 2.3.24 of Sockeye are vulnerable to code injection due to unsafe YAML loading. This means that an attacker can embed arbitrary code in the config files of trained models, potentially leading to the execution of malicious code when users download and run the model.
Vulnerability Detail
The vulnerability in Sockeye arises from its use of unsafe YAML loading. This allows an attacker to inject malicious code into the config files of trained models. If users unknowingly download and run these models, the embedded code will execute locally on their systems. The impact of this vulnerability can be severe, as it enables arbitrary code execution and potential compromise of the user's machine.
How To Fix
Minimum fixed version
2.3.24
This is the first release that contains the fix.
pip install --upgrade "sockeye==2.3.24"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended course of action is to update to the fixed version of Sockeye.
Conclusion
In conclusion, the vulnerability in Sockeye allows for code injection via unsafe YAML loading. It is crucial to update to version 2.3.24 or above to mitigate the risk of arbitrary code execution. Users should also exercise caution when downloading and running models or configurations from untrusted sources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sockeye →
FAQ
The impact of this vulnerability is that an attacker can execute arbitrary code on a user's system by embedding it in the config files of trained models. This can lead to unauthorized access, data theft, and potential compromise of the user's machine.
You can use the Vulert Playground at Vulert Scanner to check if your version of Sockeye is affected by this vulnerability. Simply input your Pipfile.lock and it will provide real-time alerts for open-source vulnerabilities.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to update to the fixed version of Sockeye to mitigate the risk of potential exploitation.
The recommended approach is to update Sockeye to the fixed version. However, if updating is not immediately feasible, you can minimize the risk by avoiding the download and execution of untrusted models or configurations.
This vulnerability was reported by Masatoshi Yoshizawa of the yamory Security Team.
