PT-2018-3945 · Pyyaml+1 · Pyyaml+1
Alex
·
Published
2018-06-27
·
Updated
2024-07-12
·
CVE-2017-18342
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PyYAML versions prior to 5.1
Description
The issue is related to the
yaml.load() API, which could execute arbitrary code if used with untrusted data. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function. The estimated number of potentially affected devices worldwide is not available.Recommendations
For PyYAML versions prior to 5.1, consider using the
yaml.safe load() function instead of yaml.load() to prevent arbitrary code execution. As a temporary workaround, consider disabling the yaml.load() function until a patch is available. Restrict access to untrusted data to minimize the risk of exploitation.Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Pyyaml