CVEvulnerability
CVE-2017-18342
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-06-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Affected configurations
• pyyaml pyyaml (< 5.1)
• fedoraproject fedora 28
• fedoraproject fedora 29
• fedoraproject fedora 30
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://github.com/marshmallow-code/apispec/issues/278 Third Party Advisory
- https://github.com/yaml/pyyaml/blob/master/CHANGES Release Notes, Third Party Advisory
- https://github.com/yaml/pyyaml/issues/193 Third Party Advisory
- https://github.com/yaml/pyyaml/pull/74 Patch, Third Party Advisory
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation github.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202003-45 Third Party Advisory
- https://github.com/marshmallow-code/apispec/issues/278 Third Party Advisory
- https://github.com/yaml/pyyaml/blob/master/CHANGES Release Notes, Third Party Advisory
- https://github.com/yaml/pyyaml/issues/193 Third Party Advisory
- https://github.com/yaml/pyyaml/pull/74 Patch, Third Party Advisory
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation github.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202003-45 Third Party Advisory