Bug 1217858 (CVE-2023-49297)

Summary:	VUL-0: CVE-2023-49297: pydrive2: potential arbitrary code execution via unsafe YAML deserilization
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Python	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	andrea.mattiazzo, mmachova, steven.kowalik
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/387160/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-12-06 16:19:24 UTC

PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-49297
https://github.com/iterative/PyDrive2/security/advisories/GHSA-v5f6-hjmf-9mc5

Patch:
https://github.com/iterative/PyDrive2/commit/c57355dc2033ad90b7050d681b2c3ba548ff0004

Comment 2 Markéta Machová 2023-12-07 10:18:14 UTC

https://build.opensuse.org/request/show/1131578

Comment 3 Markéta Machová 2023-12-08 14:05:08 UTC

Already in Factory.

Comment 4 Andrea Mattiazzo 2023-12-11 10:57:44 UTC

Released