CVE-2018-1000167: oisf suricata-update Deserialization of Untrusted Data

Vulnerability summary

CVE-2018-1000167 is a high (CVSS 9.3) Deserialization of Untrusted Data vulnerability in oisf suricata-update. EPSS estimates a 4.05% chance of exploitation in the next 30 days, higher than 90.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-04-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote Code Execution(even as root if suricata-update is called by root). This attack appears to be exploitable via a specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have been fixed in 1.0.0b1.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.