Re:RegreSSHion: RCE in OpenSSH's server, on glibc-based Linu...
by Elucalidavah on Monday July 01, 2024 @03:59PM
(#40849970)
> Imagine I make a serialisation/deserialisation library which would be vulnerable if you fed it untrusted data
No need to imagine, the PyYAML has that situation. There have been attempts to use the safe deserialization by default, with an attempt to release a new major version (rolled back), and it settled on having a required argument of which mode / loader to use. See: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PyYAML
No need to imagine, the PyYAML has that situation. There have been attempts to use the safe deserialization by default, with an attempt to release a new major version (rolled back), and it settled on having a required argument of which mode / loader to use. See: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PyYAML