kritik
CVE-2017-18342
PyYAML: yaml.load() API could execute arbitrary code
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Photon OS. Daha düşük diyenler: Red Hat (yüksek), Oracle (yüksek).
Açıklama
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-3.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-3.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-3.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.1 |
| debian 11 | pyyaml | 5.1.2-1 |
| debian 12 | pyyaml | 5.1.2-1 |
| debian 13 | pyyaml | 5.1.2-1 |
| debian 14 | pyyaml | 5.1.2-1 |
| echo | pyyaml | 5.1.2-1 |
| Oracle Linux 8 | ol-automation-manager, ol-automation-manager-cli, python3-olamkit | 1.0.2-1.el8 |
| Red Hat | PyYAML, python2-pyyaml, python27-PyYAML ve 3 tane daha | düzeltme belirtilmemiş |
11 kaynaktaki 18 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-3.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-3.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-3.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.1 |
| debian 11 | pyyaml | 5.1.2-1 |
| debian 12 | pyyaml | 5.1.2-1 |
| debian 13 | pyyaml | 5.1.2-1 |
| debian 14 | pyyaml | 5.1.2-1 |
| echo | pyyaml | 5.1.2-1 |
| Oracle Linux 8 | ol-automation-manager | 1.0.2-1.el8 |
| Oracle Linux 8 | ol-automation-manager-cli | 1.0.2-1.el8 |
| Oracle Linux 8 | python3-olamkit | 1.0.2-1.el8 |
| Red Hat | PyYAML | düzeltme belirtilmemiş |
| Red Hat | python2-pyyaml | düzeltme belirtilmemiş |
| Red Hat | python27-PyYAML | düzeltme belirtilmemiş |
| Red Hat | python38-pyyaml | düzeltme belirtilmemiş |
| Red Hat | python39-pyyaml | düzeltme belirtilmemiş |
| Red Hat | rh-python36-PyYAML | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/security/cve/CVE-2017-18342
- https://github.com/marshmallow-code/apispec/issues/278
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml
- https://github.com/yaml/pyyaml
- https://github.com/yaml/pyyaml/blob/master/CHANGES
- https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80
- https://github.com/yaml/pyyaml/issues/193
- https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007
21 referansın hepsi
- https://github.com/yaml/pyyaml/pull/74
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation
- https://linux.oracle.com/cve/CVE-2017-18342.html
- https://linux.oracle.com/errata/ELSA-2022-9341.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
- https://nvd.nist.gov/vuln/detail/CVE-2017-18342
- https://security.gentoo.org/glsa/202003-45
- https://www.cve.org/CVERecord?id=CVE-2017-18342