CVE-2023-49297: iterative pydrive2

csirt@kutim:~/threat-intel/cve/CVE-2023-49297

CVSS 7.8 · High EPSS 0,51%

Kerentanan Deserialization of Untrusted Data pada iterative pydrive2. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 5 Desember 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 0,51% peluang dieksploitasi; lebih tinggi dari 41,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
iterative	pydrive2	Semua versi sebelum 1.16.2
iterative	pydrive2	Versi 1.17.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.