In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-18342US | critical9.8 | — | ||
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' ha… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-rprw-h62v-c2w7ADVISORY
- https://github.com/marshmallow-code/apispec/issues/278REPORT
- https://github.com/yaml/pyyaml/blob/master/CHANGESWEB
- https://github.com/yaml/pyyaml/issues/193REPORT
- https://github.com/yaml/pyyaml/pull/74WEB
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-DeprecationWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan