CVE-2018-17175
In marshmallow library the schema "only" option treats an empty list as implying no "only" option
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
CVE-2018-17175- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
CVE-2018-17175- Updated
- 2026-11-02
EUVDEUVD-2018-0090 No score
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
EUVD-2018-0090- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9q2p-fj49-vpxj
In marshmallow library the schema "only" option treats an empty list as implying no "only" option
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
GHSA-9q2p-fj49-vpxj- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-358
- Updated
- 2026-11-02
OSV
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
CVE-2018-17175- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-17175
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
DEBIAN-CVE-2018-17175- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-9q2p-fj49-vpxj
In marshmallow library the schema "only" option treats an empty list as implying no "only" option
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
GHSA-9q2p-fj49-vpxj- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-358
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-17175
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
UBUNTU-CVE-2018-17175- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0065 No score
Updated python-marshmallow packages fix security vulnerability
In the marshmallow library before 2.15.1 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only") (CVE-2018-17175).
- Record
MGASA-2019-0065- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11238-1 No score
python-marshmallow-docs-3.11.1-1.3 on GA media
These are all security issues fixed in the python-marshmallow-docs-3.11.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11238-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14147-1 No score
python-marshmallow-doc-3.20.2-2.2 on GA media
These are all security issues fixed in the python-marshmallow-doc-3.20.2-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14147-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12017-1 No score
python313-marshmallow-4.3.0-1.2 on GA media
These are all security issues fixed in the python313-marshmallow-4.3.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12017-1- Updated
- 2026-11-02
OSVPYSEC-2018-67 No score
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- Record
PYSEC-2018-67- Updated
- 2026-11-02
OSVUSN-8225-1 No score
python-marshmallow vulnerabilities
Jared Deckard discovered that Python marshmallow did not correctly handle hiding certain fields. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-17175)
It was discovered that Python marshmallow did not efficiently handle merging certain objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2025-68480)
- Record
USN-8225-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
marshmallowPyPI |
before 2.15.1 | 2.15.1 |
marshmallowPyPI |
3.0a0 up to 3.0.0b9 | 3.0.0b9 |
python-marshmallowDebian:12 |
before 3.0.0b14-1 | 3.0.0b14-1 |
python-marshmallowDebian:13 |
before 3.0.0b14-1 | 3.0.0b14-1 |
python-marshmallowDebian:14 |
before 3.0.0b14-1 | 3.0.0b14-1 |
marshmallowPyPI |
before 2.15.1, plus listed versions 0.1.00.2.00.2.10.3.00.3.1 Show 45 moreShow less0.4.00.4.10.5.00.5.10.5.20.5.30.5.40.5.50.6.00.7.01.0.01.0.0-a1.0.11.1.01.2.01.2.11.2.21.2.31.2.41.2.51.2.62.0.02.0.0a12.0.0b12.0.0b22.0.0b32.0.0b42.0.0b52.0.0rc12.0.0rc22.1.02.1.12.1.22.1.32.10.02.10.12.10.22.10.32.10.42.10.52.11.02.11.12.12.02.12.12.12.2 |
2.15.1 |
marshmallowPyPI |
3.0a0 up to 3.0.0b9, plus listed versions 3.0.0a13.0.0b13.0.0b23.0.0b33.0.0b4 Show 4 moreShow less3.0.0b53.0.0b63.0.0b73.0.0b8 |
3.0.0b9 |
python-marshmallowMageia:6 |
before 2.2.1-0.5.gitea1def9.mga6 | 2.2.1-0.5.gitea1def9.mga6 |
marshmallowPyPI |
before 2.15.1, 3.0a0 up to 3.0.0b9, plus listed versions 0.1.00.2.00.2.10.3.00.3.1 Show 45 moreShow less0.4.00.4.10.5.00.5.10.5.20.5.30.5.40.5.50.6.00.7.01.0.01.0.0-a1.0.11.1.01.2.01.2.11.2.21.2.31.2.41.2.51.2.62.0.02.0.0a12.0.0b12.0.0b22.0.0b32.0.0b42.0.0b52.0.0rc12.0.0rc22.1.02.1.12.1.22.1.32.10.02.10.12.10.22.10.32.10.42.10.52.11.02.11.12.12.02.12.12.12.2 |
2.15.13.0.0b9 |
python-marshmallowUbuntu:Pro:18.04:LTS |
before 3.0.0b3-1ubuntu0.1~esm1, plus listed versions 3.0.0b3-1 |
3.0.0b3-1ubuntu0.1~esm1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-marshmallowUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 3.0.0b3-1ubuntu0.1~esm1, plus listed versions 3.0.0b3-1 |
3.0.0b3-1ubuntu0.1~esm1 |
python-marshmallowUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 3.4.0-1ubuntu0.1~esm1, plus listed versions 3.0.0b14-13.2.1-13.2.2-13.3.0-13.4.0-1 |
3.4.0-1ubuntu0.1~esm1 |
python-marshmallowUbuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 3.13.0-1ubuntu0.1~esm1, plus listed versions 3.10.0-13.13.0-1 |
3.13.0-1ubuntu0.1~esm1 |
python-marshmallowUbuntu:Pro:24.04:LTS From an advisory covering 2 CVEs |
before 3.20.1-1.1ubuntu0.1~esm1, plus listed versions 3.18.0-13.20.1-1.1 |
3.20.1-1.1ubuntu0.1~esm1 |
python-marshmallowUbuntu:Pro:26.04:LTS From an advisory covering 2 CVEs |
before 3.26.1-0.4ubuntu0.1~esm1, plus listed versions 3.26.1-0.23.26.1-0.33.26.1-0.4 |
3.26.1-0.4ubuntu0.1~esm1 |
python-marshmallowopenSUSE:Tumbleweed |
before 3.20.2-2.2 | 3.20.2-2.2 |
python-marshmallowopenSUSE:Tumbleweed |
before 4.3.0-1.2 | 4.3.0-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-17175 is a medium vulnerability (CVSS 5.3) in Marshmallow Project Marshmallow, published September 18, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 79th percentile. Fixed in marshmallow 2.15.1.
References
github.com/marshmallow-code/marshmallow/pull/777
nvd.nist.gov/vuln/detail/CVE-2018-17175
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2018-17175
advisories.mageia.org/MGASA-2019-0065.html
bugs.mageia.org/show_bug.cgi?id=23703
lists.fedoraproject.org/archives/list/[email protected]/thread/GCKZAADQI7JJ3ZUN7DSIR2JH3VZEJZDM
ubuntu.com/security/CVE-2018-17175
cve.org/CVERecord?id=CVE-2018-17175
suse.com/security/cve/CVE-2018-17175
Left out here: 59 versions. The JSON record has them.