CVE-2018-17175: Information Exposure
(updated )
In the marshmallow library the schema only
option treats an empty list as implying no only
option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the only
option, and there is a user role that produces an empty value for only
).
References
- cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17175
- cwe.mitre.org/data/definitions/200.html
- github.com/marshmallow-code/marshmallow/commit/98f2b4759c9a7c7ac5e790727d47f2b328520713
- github.com/marshmallow-code/marshmallow/issues/772
- github.com/marshmallow-code/marshmallow/pull/777
- github.com/marshmallow-code/marshmallow/pull/782
- nvd.nist.gov/vuln/detail/CVE-2018-17175
Detect and mitigate CVE-2018-17175 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →