CVE-2021-39207 : parlai is a framework for training and evaluating AI models on a variety of open

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.

Published 2021-09-10 23:15:07

Updated 2021-09-23 15:47:49

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-39207

Facebook » Parlai
Versions before (<) 1.1.0
cpe:2.3:a:facebook:parlai:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-39207

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-39207

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.4	HIGH	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L	1.8	6.0	GitHub, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: Low

CWE ids for CVE-2021-39207

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2021-39207

https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879

Update model_chat_blueprint.py (#3429) · facebookresearch/ParlAI@4374fa2 · GitHub
Patch;Third Party Advisory
https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg

Deserialization of Untrusted Data in parlai · Advisory · facebookresearch/ParlAI · GitHub
Patch;Third Party Advisory

CVEs referencing this url
https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725

RCE Fixed (#3402) · facebookresearch/ParlAI@507d066 · GitHub
Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-39207

Products affected by CVE-2021-39207

Exploit prediction scoring system (EPSS) score for CVE-2021-39207

CVSS scores for CVE-2021-39207

CWE ids for CVE-2021-39207

References for CVE-2021-39207