Search criteria
2 vulnerabilities found for integration-jira-cloud by tenable
CVE-2021-21371 (GCVE-0-2021-21371)
Vulnerability from cvelistv5 – Published: 2021-03-10 21:50 – Updated: 2024-08-03 18:09
VLAI?
Title
Execution of untrusted code through config file
Summary
Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load().
Severity ?
5 (Medium)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| tenable | integration-jira-cloud |
Affected:
< 1.1.21
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:09:15.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pypi.org/project/tenable-jira-cloud/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "integration-jira-cloud",
"vendor": "tenable",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.21"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities\u0027 current state. It published in pypi as \"tenable-jira-cloud\". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load()."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-10T21:50:14",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pypi.org/project/tenable-jira-cloud/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml"
}
],
"source": {
"advisory": "GHSA-8278-88vv-x98r",
"discovery": "UNKNOWN"
},
"title": "Execution of untrusted code through config file",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21371",
"STATE": "PUBLIC",
"TITLE": "Execution of untrusted code through config file"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "integration-jira-cloud",
"version": {
"version_data": [
{
"version_value": "\u003c 1.1.21"
}
]
}
}
]
},
"vendor_name": "tenable"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities\u0027 current state. It published in pypi as \"tenable-jira-cloud\". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load()."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502 Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r",
"refsource": "CONFIRM",
"url": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r"
},
{
"name": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0",
"refsource": "MISC",
"url": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0"
},
{
"name": "https://pypi.org/project/tenable-jira-cloud/",
"refsource": "MISC",
"url": "https://pypi.org/project/tenable-jira-cloud/"
},
{
"name": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml",
"refsource": "MISC",
"url": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml"
}
]
},
"source": {
"advisory": "GHSA-8278-88vv-x98r",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-21371",
"datePublished": "2021-03-10T21:50:14",
"dateReserved": "2020-12-22T00:00:00",
"dateUpdated": "2024-08-03T18:09:15.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-21371 (GCVE-0-2021-21371)
Vulnerability from nvd – Published: 2021-03-10 21:50 – Updated: 2024-08-03 18:09
VLAI?
Title
Execution of untrusted code through config file
Summary
Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load().
Severity ?
5 (Medium)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| tenable | integration-jira-cloud |
Affected:
< 1.1.21
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:09:15.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pypi.org/project/tenable-jira-cloud/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "integration-jira-cloud",
"vendor": "tenable",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.21"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities\u0027 current state. It published in pypi as \"tenable-jira-cloud\". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load()."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-10T21:50:14",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pypi.org/project/tenable-jira-cloud/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml"
}
],
"source": {
"advisory": "GHSA-8278-88vv-x98r",
"discovery": "UNKNOWN"
},
"title": "Execution of untrusted code through config file",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21371",
"STATE": "PUBLIC",
"TITLE": "Execution of untrusted code through config file"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "integration-jira-cloud",
"version": {
"version_data": [
{
"version_value": "\u003c 1.1.21"
}
]
}
}
]
},
"vendor_name": "tenable"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities\u0027 current state. It published in pypi as \"tenable-jira-cloud\". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load()."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502 Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r",
"refsource": "CONFIRM",
"url": "https://github.com/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r"
},
{
"name": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0",
"refsource": "MISC",
"url": "https://github.com/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0"
},
{
"name": "https://pypi.org/project/tenable-jira-cloud/",
"refsource": "MISC",
"url": "https://pypi.org/project/tenable-jira-cloud/"
},
{
"name": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml",
"refsource": "MISC",
"url": "https://pyyaml.docsforge.com/master/documentation/#loading-yaml"
}
]
},
"source": {
"advisory": "GHSA-8278-88vv-x98r",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-21371",
"datePublished": "2021-03-10T21:50:14",
"dateReserved": "2020-12-22T00:00:00",
"dateUpdated": "2024-08-03T18:09:15.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}