CVE-2021-21371 json
Execution of untrusted code through config file
published 5y ago modified last mo. also GHSA-8278-88vv-x98r , PYSEC-2021-60 , EUVD-2021-0252
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load().
Patch / fix
- pypi tenable-jira-cloud 1.1.21, 1.1.22
- tenable jira_cloud 1.1.21
Is CVE-2021-21371 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 5.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | tenable-jira-cloud | <1.1.21 <1.1.22 |
1.1.21 1.1.22 |
Affected products
- tenable integration-jira-cloud
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/tenable/integration-jira-cloud/commit/f8c2095fd529e664e7fa25403a0a4a85bb3907d0
web, patch, third-party-advisory
-
github.com
/tenable/integration-jira-cloud/security/advisories/GHSA-8278-88vv-x98r
web, third-party-advisory, advisory
-
pypi.org
/project/tenable-jira-cloud/
product, third-party-advisory, package
-
pyyaml.docsforge.com
/master/documentation/#loading-yaml
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2021-21371
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/tenable-jira-cloud/PYSEC-2021-60.yaml
web
-
github.com
/tenable/integration-jira-cloud
package
-
pypi.org
/project/tenable-jira-cloud
web
Sources
- CVE List CVE-2021-21371
- GitHub Advisory GHSA-8278-88vv-x98r
- NVD CVE-2021-21371
- OSV PYSEC-2021-60
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.