Deserialization in Iterative Pydrive2
CVE-2023-49297
PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Insecure Deserialization
EPSS: 0.005 (40.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.
Affected products
- Iterative Pydrive2 — versions 1.17.0, = 1.17.0, < 1.16.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com
- security-advisories@github.com
Frequently asked questions
- What is CVE-2023-49297?
- CVE-2023-49297 is a low-severity vulnerability in Iterative Pydrive2, classified under Deserialization of Untrusted Data. CVSS score: 3.3/10. Published 2023-12-05.
- How severe is CVE-2023-49297?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2023-49297 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.