How severe is CVE-2018-1000167?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.8 out of 10.

What type of vulnerability is CVE-2018-1000167?

This is classified as CWE-502, which is a common weakness in software security.

CVE-2018-1000167 - HIGH Severity | CVSS 7.8

Vulnerability Description

OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote Code Execution(even as root if suricata-update is called by root). This attack appears to be exploitable via a specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have been fixed in 1.0.0b1.

Related Vulnerabilities

CVE-2011-2520

HIGH

CVSS:7.8(High)

fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privile...

CWE-5022011

CVE-2017-0806

HIGH

CVSS:7.8(High)

An elevation of privilege vulnerability in the Android framework (gatekeeperresponse). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62998805.

CWE-5022017

CVE-2017-12612

HIGH

CVSS:7.8(High)

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially...

CWE-5022017

CVE-2017-12628

HIGH

CVSS:7.8(High)

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX sock...

CWE-5022017

CVE-2017-13286

HIGH

CVSS:7.8(High)

In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serialization. This could lead to a local escalation of privilege where the user can sta...

CWE-5022017

CVE-2017-1677

HIGH

CVSS:7.8(High)

IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially ...

CWE-5022017