GHSA-8278-88vv-x98r

Execution of untrusted code through config file

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21371

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	tenable-jira-cloud	< 1.1.21	1.1.21

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact It is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. ### Workarounds Manually adjust yaml.load() to yaml.safe_load() ### For more information If you have any questions or comments about this advisory: * Open an issue in [tenable/integration-jira-cloud](https://github.com/tenable/integration-jira-cloud/issues) * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.

https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r web
https://nvd.nist.gov/vuln/detail/CVE-2021-21371 advisory
https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0 web
https://github.com/pypa/advisory-database/tree/main/vulns/tenable-jira-cloud/PYSEC-2021-60.yaml web
https://github.com/tenable/integration-jira-cloud package
https://pypi.org/project/tenable-jira-cloud web