CVE-2018-1000167 json
OISF suricata-update unsafely deserializes YAML data
published 8y ago modified 4mo ago also GHSA-7c4h-w765-6pwg , PYSEC-2018-75 , EUVD-2018-0138
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.0%
- EPSS 4.0% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote Code Execution(even as root if suricata-update is called by root). This attack appears to be exploitable via a specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have been fixed in 1.0.0b1.
Patch / fix
- pypi suricata-update 1.0.0b1
- github.com/OISF/suricata-update@76270e7 commit
- github.com/OISF/suricata-update#23 pull request
Is CVE-2018-1000167 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
4.04% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- tech.feedyourhead.at https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| GitHub | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | suricata-update | <1.0.0b1 |
1.0.0b1 |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/OISF/suricata-update/pull/23
web
-
github.com
/OISF/suricata-update/commit/76270e73128ca1299b4e33e7e2a74ac3d963a97a
web
-
tech.feedyourhead.at
/content/remote-code-execution-in-suricata-update
web, exploit, third-party-advisory
-
redmine.openinfosecfoundation.org
/issues/2359
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-1000167
advisory
-
github.com
/OISF/suricata-update
package
-
github.com
/pypa/advisory-database/tree/main/vulns/suricata-update/PYSEC-2018-75.yaml
web
-
github.com
/advisories/GHSA-7c4h-w765-6pwg
advisory
Sources
- CVE List CVE-2018-1000167
- GitHub Advisory GHSA-7c4h-w765-6pwg
- NVD CVE-2018-1000167
- OSV PYSEC-2018-75
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.