CVE-2021-43811High· 7.8▾ MidnightPoC availableCode injection via unsafe YAML loading
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.4%
1 GitHub repo
Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files.
An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally.
The issue is fixed in version 2.3.24 and above by #964.
If you have any questions or comments about this advisory:
This vulnerability was reported by Masatoshi Yoshizawa of yamory Security Team.
sockeye < 2.3.24Upgrade to a patched release:
sockeye 2.3.24Field changes observed since this record was first indexed.