CVE-2017-18342

CRITICAL

9.8

Description

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie6/27/2018

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

fedoraproject:fedorapyyaml:pyyaml

Faiblesses (CWE)

CWE-502

References

https://github.com/marshmallow-code/apispec/issues/278(cve@mitre.org)

https://github.com/yaml/pyyaml/blob/master/CHANGES(cve@mitre.org)

https://github.com/yaml/pyyaml/issues/193(cve@mitre.org)

https://github.com/yaml/pyyaml/pull/74(cve@mitre.org)

https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/(cve@mitre.org)

https://security.gentoo.org/glsa/202003-45(cve@mitre.org)

https://github.com/marshmallow-code/apispec/issues/278(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/yaml/pyyaml/blob/master/CHANGES(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/yaml/pyyaml/issues/193(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/yaml/pyyaml/pull/74(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202003-45(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.