critique
CVE-2017-18342
PyYAML: yaml.load() API could execute arbitrary code
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon Red Hat (élevée), Oracle (élevée).
Description
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-3.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-3.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-3.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.1 |
| debian 11 | pyyaml | 5.1.2-1 |
| debian 12 | pyyaml | 5.1.2-1 |
| debian 13 | pyyaml | 5.1.2-1 |
| debian 14 | pyyaml | 5.1.2-1 |
| echo | pyyaml | 5.1.2-1 |
| Oracle Linux 8 | ol-automation-manager, ol-automation-manager-cli, python3-olamkit | 1.0.2-1.el8 |
| Red Hat | PyYAML, python2-pyyaml, python27-PyYAML et 3 autres | pas de correctif indiqué |
Afficher les 18 entrées de 11 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-3.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-3.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-3.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.1 |
| debian 11 | pyyaml | 5.1.2-1 |
| debian 12 | pyyaml | 5.1.2-1 |
| debian 13 | pyyaml | 5.1.2-1 |
| debian 14 | pyyaml | 5.1.2-1 |
| echo | pyyaml | 5.1.2-1 |
| Oracle Linux 8 | ol-automation-manager | 1.0.2-1.el8 |
| Oracle Linux 8 | ol-automation-manager-cli | 1.0.2-1.el8 |
| Oracle Linux 8 | python3-olamkit | 1.0.2-1.el8 |
| Red Hat | PyYAML | pas de correctif indiqué |
| Red Hat | python2-pyyaml | pas de correctif indiqué |
| Red Hat | python27-PyYAML | pas de correctif indiqué |
| Red Hat | python38-pyyaml | pas de correctif indiqué |
| Red Hat | python39-pyyaml | pas de correctif indiqué |
| Red Hat | rh-python36-PyYAML | pas de correctif indiqué |
Références
- https://access.redhat.com/security/cve/CVE-2017-18342
- https://github.com/marshmallow-code/apispec/issues/278
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml
- https://github.com/yaml/pyyaml
- https://github.com/yaml/pyyaml/blob/master/CHANGES
- https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80
- https://github.com/yaml/pyyaml/issues/193
- https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007
Les 21 références
- https://github.com/yaml/pyyaml/pull/74
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation
- https://linux.oracle.com/cve/CVE-2017-18342.html
- https://linux.oracle.com/errata/ELSA-2022-9341.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
- https://nvd.nist.gov/vuln/detail/CVE-2017-18342
- https://security.gentoo.org/glsa/202003-45
- https://www.cve.org/CVERecord?id=CVE-2017-18342