SB2023121313 - Deserialization of untrusted data in PyDrive2
Published: December 13, 2023
Security Bulletin ID
SB2023121313
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Deserialization of Untrusted Data (CVE-ID: CVE-2023-49297)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can trick the victim to load a specially crafted YAML file and execute arbitrary code on the system.
Successful exploitation of the vulnerability requires that PyDrive2 is run in the same directory as the malicious YAML file or if it is loaded in via LoadSettingsFile.
Remediation
Install update from vendor's website.