{"id":"CVE-2018-17175","aliases":["DEBIAN-CVE-2018-17175","EUVD-2018-0090","GHSA-9q2p-fj49-vpxj","MGASA-2019-0065","PYSEC-2018-67","UBUNTU-CVE-2018-17175","USN-8225-1","openSUSE-SU-2024:11238-1","openSUSE-SU-2024:14147-1","openSUSE-SU-2026:12017-1"],"status":"published","title":"In marshmallow library the schema \"only\" option treats an empty list as implying no \"only\" option","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01919,"percentile":0.80026,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-358"],"published":"2018-09-18T17:00:00Z","modified":"2026-10-23T18:03:20Z","fixes":[{"ecosystem":"PyPI","package":"marshmallow","fixed_in":["2.15.1","3.0.0b9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-marshmallow","fixed_in":["3.0.0b14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-marshmallow","fixed_in":["3.0.0b14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-marshmallow","fixed_in":["3.0.0b14-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"python-marshmallow","fixed_in":["2.2.1-0.5.gitea1def9.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-marshmallow","fixed_in":["3.0.0b3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-marshmallow","fixed_in":["3.20.2-2.2","4.3.0-1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0a0"},{"fixed":"3.0.0b9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0b14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0b14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0b14-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.6.0","0.7.0","1.0.0","1.0.0-a","1.0.1","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","2.0.0","2.0.0a1","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0rc1","2.0.0rc2","2.1.0","2.1.1","2.1.2","2.1.3","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.14.0","2.15.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.4.2","2.5.0","2.6.0","2.6.1","2.7.0","2.7.1","2.7.2","2.7.3","2.8.0","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0a0"},{"fixed":"3.0.0b9"}]}],"versions":["3.0.0a1","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.0b5","3.0.0b6","3.0.0b7","3.0.0b8"]},{"source":"osv","ecosystem":"Mageia:6","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-0.5.gitea1def9.mga6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1"},{"introduced":"3.0a0"},{"fixed":"3.0.0b9"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.6.0","0.7.0","1.0.0","1.0.0-a","1.0.1","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","2.0.0","2.0.0a1","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0rc1","2.0.0rc2","2.1.0","2.1.1","2.1.2","2.1.3","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.14.0","2.15.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.4.2","2.5.0","2.6.0","2.6.1","2.7.0","2.7.1","2.7.2","2.7.3","2.8.0","2.9.0","2.9.1","3.0.0a1","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.0b5","3.0.0b6","3.0.0b7","3.0.0b8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0b3-1ubuntu0.1~esm1"}]}],"versions":["3.0.0b3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0b3-1ubuntu0.1~esm1"}]}],"versions":["3.0.0b3-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-1ubuntu0.1~esm1"}]}],"versions":["3.0.0b14-1","3.2.1-1","3.2.2-1","3.3.0-1","3.4.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-1ubuntu0.1~esm1"}]}],"versions":["3.10.0-1","3.13.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.1-1.1ubuntu0.1~esm1"}]}],"versions":["3.18.0-1","3.20.1-1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.1-0.4ubuntu0.1~esm1"}]}],"versions":["3.26.1-0.2","3.26.1-0.3","3.26.1-0.4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-2.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1.2"}]}]}],"products":[{"vendor":"marshmallow_project","product":"marshmallow"}],"references":[{"url":"https://github.com/marshmallow-code/marshmallow/pull/777","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/marshmallow-code/marshmallow/pull/782","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/marshmallow-code/marshmallow/issues/772","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17175","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/marshmallow/PYSEC-2018-67.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9q2p-fj49-vpxj","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-17175","tags":["advisory"]},{"url":"https://github.com/marshmallow-code","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2019-0065.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23703","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GCKZAADQI7JJ3ZUN7DSIR2JH3VZEJZDM/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-17175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-17175","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8225-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68480","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17175","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-17175","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-09-18T17:00:00Z","modified":"2024-09-17T02:16:40.69Z","updated_at":"2026-11-02T14:35:07.354449Z"}],"euvd":[{"id":"EUVD-2018-0090","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-09-18T17:00:00Z","modified":"2024-09-17T02:16:40Z","updated_at":"2026-11-03T00:28:41.906947Z"}],"ghsa":[{"id":"GHSA-9q2p-fj49-vpxj","title":"In marshmallow library the schema \"only\" option treats an empty list as implying no \"only\" option","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-10-10T16:10:46Z","modified":"2024-09-24T20:09:29Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2018-17175","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-09-18T17:29:01.867Z","modified":"2026-06-17T01:45:28.46Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"CVE-2018-17175","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-09-18T17:29:01.867Z","modified":"2026-10-20T10:50:22.582637617Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-17175","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-09-18T17:29:01.867Z","modified":"2026-10-23T18:03:20.528656248Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"GHSA-9q2p-fj49-vpxj","title":"In marshmallow library the schema \"only\" option treats an empty list as implying no \"only\" option","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-10-10T16:10:46Z","modified":"2024-09-24T20:22:58.20768Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"UBUNTU-CVE-2018-17175","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-09-18T17:29:00Z","modified":"2026-04-30T09:27:28.795629Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"MGASA-2019-0065","title":"Updated python-marshmallow packages fix security vulnerability","description":"In the marshmallow library before 2.15.1 for Python, the schema \"only\"\noption treats an empty list as implying no \"only\" option, which allows a\nrequest that was intended to expose no fields to instead expose all fields\n(if the schema is being filtered dynamically using the \"only\" option, and\nthere is a user role that produces an empty value for \"only\")\n(CVE-2018-17175).\n","status":"published","published":"2019-02-13T11:08:25Z","modified":"2026-04-16T04:43:48.807780484Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11238-1","title":"python-marshmallow-docs-3.11.1-1.3 on GA media","description":"These are all security issues fixed in the python-marshmallow-docs-3.11.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:34.789213Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14147-1","title":"python-marshmallow-doc-3.20.2-2.2 on GA media","description":"These are all security issues fixed in the python-marshmallow-doc-3.20.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:40:46.688179Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:12017-1","title":"python313-marshmallow-4.3.0-1.2 on GA media","description":"These are all security issues fixed in the python313-marshmallow-4.3.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:08.672794453Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2018-67","description":"In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").","status":"published","published":"2018-09-18T17:29:00Z","modified":"2023-11-08T04:00:03.100972Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"USN-8225-1","title":"python-marshmallow vulnerabilities","description":"Jared Deckard discovered that Python marshmallow did not correctly\nhandle hiding certain fields. An attacker could possibly use this issue\nto leak sensitive information. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2018-17175)\n\nIt was discovered that Python marshmallow did not efficiently handle\nmerging certain objects. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2025-68480)","status":"published","published":"2026-04-30T02:19:38Z","modified":"2026-04-30T10:00:02.634492536Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}