PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
In PyYAML before 5.1, the `yaml.load()` API could execute arbitrary code. In other words, `yaml.safe_load` is not used. This was intended to be fixed in 4.1, but due to [breaking changes](https://github.com/yaml/pyyaml/issues/192#issuecomment-401491470), 4.1 was yanked and 5.1 [contains](https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007) the patch for CVE-2017-18342.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-18342US | critical9.8 | — | ||
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' ha… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/marshmallow-code/apispec/issues/278WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yamlWEB
- https://github.com/yaml/pyyamlPACKAGE
- https://github.com/yaml/pyyaml/blob/master/CHANGESWEB
- https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80WEB
- https://github.com/yaml/pyyaml/issues/193WEB
- https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007WEB
- https://github.com/yaml/pyyaml/pull/74WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan