In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema only option     treats an empty list as implying no only option, which allows a request that was intended to expose no     fields to instead expose all fields (if the schema is being filtered dynamically using the only option,     and there is a user role that produces an empty value for only). (CVE-2018-17175)

Note that Nessus relies on the presence of the package as reported by the vendor.

Security fix for CVE-2018-17175

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
256602	Linux Distros Unpatched Vulnerability : CVE-2018-17175	Nessus	Misc.	medium
120796	Fedora 28 : python-marshmallow (2018-cc9adc4808)	Nessus	Fedora Local Security Checks	medium
120614	Fedora 29 : python-marshmallow (2018-9006b64e41)	Nessus	Fedora Local Security Checks	medium
118046	Fedora 27 : python-marshmallow (2018-8b109a6de0)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-17175

medium

Tenable Plugins

medium

medium

medium

medium