Vulnerability · Published Dec 8, 2021 · Assigned by GitHub_M

CVE-2021-43811Code injection via unsafe YAML loading

High 7.8

In plain English

A high-severity code injection in sockeye from awslabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)2.5%top 15.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	sockeye	2.3.24	GHSA-ggmr-44cv-24pm
PyPI	sockeye	2.3.24	PYSEC-2021-848

Affected products (as reported)

Vendor	Product	Versions
awslabs	sockeye	< 2.3.24

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pm x_refsource_CONFIRM
https://github.com/awslabs/sockeye/pull/964 x_refsource_MISC
https://github.com/awslabs/sockeye/releases/tag/2.3.24 x_refsource_MISC