CVE-2018-17175PYSEC-2018-67GHSA-9Q2P-FJ49-VPXJ
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "on
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.15.1, 3.0.0b9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- marshmallowPyPI
fixed in 2.15.1; From 3.0a0 · fixed in 3.0.0b9
- marshmallowPyPI
fixed in 2.15.1
- marshmallowPyPI
From 3.0a0 · fixed in 3.0.0b9