CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
28.5%
PyDrive2 is a wrapper library of google-api-python-client that simplifies
many common Google Drive API V2 tasks. Unsafe YAML deserilization will
result in arbitrary code execution. A maliciously crafted YAML file can
cause arbitrary code execution if PyDrive2 is run in the same directory as
it, or if it is loaded in via LoadSettingsFile
. This is a deserilization
attack that will affect any user who initializes GoogleAuth from this
package while a malicious yaml file is present in the same directory. This
vulnerability does not require the file to be directly loaded through the
code, only present. This issue has been addressed in commit c57355dc
which is included in release version 1.16.2
. Users are advised to
upgrade. There are no known workarounds for this vulnerability.
github.com/iterative/PyDrive2/commit/c57355dc2033ad90b7050d681b2c3ba548ff0004
github.com/iterative/PyDrive2/commit/c57355dc2033ad90b7050d681b2c3ba548ff0004 (1.16.2)
github.com/iterative/PyDrive2/security/advisories/GHSA-v5f6-hjmf-9mc5
launchpad.net/bugs/cve/CVE-2023-49297
nvd.nist.gov/vuln/detail/CVE-2023-49297
security-tracker.debian.org/tracker/CVE-2023-49297
www.cve.org/CVERecord?id=CVE-2023-49297
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
28.5%