CVE-2017-18342
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 5.6%
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Productos afectados
n/a · n/aReferencias
https://github.com/marshmallow-code/apispec/issues/278https://github.com/yaml/pyyaml/blob/master/CHANGEShttps://github.com/yaml/pyyaml/issues/193https://github.com/yaml/pyyaml/pull/74https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecationhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/https://security.gentoo.org/glsa/202003-45