Summary
Jared Deckard discovered that Python marshmallow did not correctly
handle hiding certain fields. An attacker could possibly use this issue
to leak sensitive information. This issue only affected Ubuntu 18.04 LTS.
(CVE-2018-17175)
It was discovered that Python marshmallow did not efficiently handle
merging certain objects. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2025-68480)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-marshmallow | 3.0.0b3-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-marshmallow | 3.4.0-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-marshmallow | 3.13.0-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | python-marshmallow | 3.20.1-1.1ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | python-marshmallow | 3.26.1-0.4ubuntu0.1~esm1 |
Vulnerabilities 2
-
Medium 5.3
In marshmallow library the schema "only" option treats an empty list as implying no "only" option
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is…
-
Medium 5.3
Marshmallow has DoS in Schema.load(many)
Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A mode…