CVE-2017-18342
2 advisories.
PyPI/pyyaml CVE-2017-18342: critical 9.8
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
Action: Upgrade pyyaml to 5.1 or later.
pip install pyyaml==5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.1 | - |
Fixed versions
| 5.1 |
Sources
- osv: GHSA-rprw-h62v-c2w7
- https://nvd.nist.gov/vuln/detail/CVE-2017-18342
- https://github.com/marshmallow-code/apispec/issues/278
- https://github.com/yaml/pyyaml/issues/193
- https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007
- https://github.com/yaml/pyyaml/pull/74
- https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml
- https://github.com/yaml/pyyaml
- https://github.com/yaml/pyyaml/blob/master/CHANGES
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA
- https://security.gentoo.org/glsa/202003-45
CVE-2017-18342 · published · modified · JSON
PyPI/pyyaml CVE-2017-18342: unknown
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
Action: Upgrade pyyaml to 5.1 or later.
pip install pyyaml==5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.1 | - |
Fixed versions
| 5.1 |
Sources
- osv: PYSEC-2018-49
- https://github.com/yaml/pyyaml/pull/74
- https://github.com/yaml/pyyaml/blob/master/CHANGES
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
- https://github.com/marshmallow-code/apispec/issues/278
- https://github.com/yaml/pyyaml/issues/193
- https://security.gentoo.org/glsa/202003-45
- https://github.com/advisories/GHSA-rprw-h62v-c2w7
CVE-2017-18342 · published · modified · JSON