CVE-2017-18342 PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
CriticalCVSS 9.8
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pyyaml(PyPI) | < 5.1 | 5.1 |
| pypi pyyaml(PyPI) | = 3.01 | No fix listed |
| pypi pyyaml(PyPI) | = 3.02 | No fix listed |
| pypi pyyaml(PyPI) | = 3.03 | No fix listed |
| pypi pyyaml(PyPI) | = 3.04 | No fix listed |
| pypi pyyaml(PyPI) | = 3.05 | No fix listed |
| pypi pyyaml(PyPI) | = 3.06 | No fix listed |
| pypi pyyaml(PyPI) | = 3.07 | No fix listed |
| pypi pyyaml(PyPI) | = 3.08 | No fix listed |
| pypi pyyaml(PyPI) | = 3.09 | No fix listed |
| pypi pyyaml(PyPI) | = 3.10 | No fix listed |
| pypi pyyaml(PyPI) | = 3.11 | No fix listed |
| pypi pyyaml(PyPI) | = 3.12 | No fix listed |
| pypi pyyaml(PyPI) | = 3.13 | No fix listed |
| pypi pyyaml(PyPI) | = 3.13b1 | No fix listed |
| pypi pyyaml(PyPI) | = 3.13rc1 | No fix listed |
| pypi pyyaml(PyPI) | = 4.2b1 | No fix listed |
| pypi pyyaml(PyPI) | = 4.2b2 | No fix listed |
| pypi pyyaml(PyPI) | = 4.2b4 | No fix listed |
| pypi pyyaml(PyPI) | = 5.1b1 | No fix listed |
| pypi pyyaml(PyPI) | = 5.1b3 | No fix listed |
| pypi pyyaml(PyPI) | = 5.1b5 | No fix listed |
| pypi pyyaml(PyPI) | = 5.1b7 | No fix listed |
| debian/pyyaml(Debian:12) | < 5.1.2-1 | 5.1.2-1 |
| debian/pyyaml(Debian:13) | < 5.1.2-1 | 5.1.2-1 |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pyyaml(Debian:14) | < 5.1.2-1 | 5.1.2-1 |
| pyyaml | < 5.1 | 5.1 |
| fedoraproject fedora | = 28 | No fix listed |
| fedoraproject fedora | = 29 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com issue-tracking third-party-advisory
- github.com
- github.com patch third-party-advisory
- github.com patch
- github.com
- github.com product
- github.com release-notes third-party-advisory
- github.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- GLSA-202003-45 third-party-advisory vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2017-18342 vendor-advisory
- github.com
- FEDORA-2019-44643e8bcb vendor-advisory
- FEDORA-2019-779a9db46a vendor-advisory
- FEDORA-2019-bed9afe622 vendor-advisory
- bugs.debian.org issue-tracking