django-tastypie vulnerabilities

The from_yaml method in serializers.py in Django Tastypie before version 0.9.10 does not properly deserialize YAML data, allowing remote attackers to execute arbitrary Python code.

In django-tastypie up to version 0.15.1, the CacheThrottle/CacheDBThrottle function in tastypie/throttle.py has a race condition vulnerability. The attack can be remote but is difficult to exploit. The project was informed but has not responded.

A vulnerability was found in django-tastypie up to version 0.15.1 in the ApiKeyAuthentication function within tastypie/authentication.py. The issue involves using the GET method with sensitive query strings, potentially leaking API keys. The attack is remote but has high complexity and is considered difficult to exploit.