Detections
Analytics

SCA: security update for yamale (GHSA-435p-f82x-mxwm)

high Tenable Self-Hosted Container Security Plugin ID 409838

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file.
 The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by
 limiting the builtins that are passed to the eval. When processing the schema, each line is run through
 Python's eval function to make the validator available. A well-constructed string within the schema rules
 can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on
 the image that invokes Yamale. (CVE-2021-38305)

See Also

https://github.com/advisories/GHSA-435p-f82x-mxwm

Plugin Details

Severity: High

ID: 409838

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-38305

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 5.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/11/2021

Vulnerability Publication Date: 8/9/2021

Reference Information

CVE: CVE-2021-38305