CVE-2021-23338: Vulnerability in pyqlib package allows unsafe YAML load function
Summary
CVE-2021-23338: This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function. Affects pyqlib versions < 0.6.3. Fixed in 0.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pyqlib package is an open-source Python library that provides various functionalities for quantitative finance and machine learning. It is commonly used for financial data analysis, backtesting trading strategies, and developing machine learning models in the finance domain. The package offers a range of features, including data preprocessing, feature engineering, model training, and evaluation. However, all versions of the package prior to version 0.6.3 are affected by a vulnerability that involves the unsafe usage of a YAML load function in the workflow function of the command-line interface (CLI) component of pyqlib.
Vulnerability Detail
The vulnerability arises from the insecure implementation of the YAML load function in the workflow function of the CLI part of pyqlib. This can potentially allow an attacker to execute arbitrary code or perform other malicious actions by crafting a specially crafted YAML file. The vulnerability could lead to unauthorized access, data manipulation, or denial of service. It is important to note that this vulnerability affects all versions of pyqlib prior to version 0.6.3.
How To Fix
Minimum fixed version
0.6.3
This is the first release that contains the fix.
pip install --upgrade "pyqlib==0.6.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in pyqlib involving the unsafe YAML load function can potentially lead to unauthorized access, data manipulation, or denial of service. It is crucial to update pyqlib to version 0.6.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pyqlib →
FAQ
pyqlib is an open-source Python library for quantitative finance and machine learning. It provides various functionalities for financial data analysis, backtesting trading strategies, and developing machine learning models in the finance domain.
The vulnerability in pyqlib could allow an attacker to execute arbitrary code or perform other malicious actions by exploiting the unsafe YAML load function. This could lead to unauthorized access, data manipulation, or denial of service.
All versions of pyqlib prior to version 0.6.3 are affected by this vulnerability.
To fix this vulnerability, it is recommended to update pyqlib to version 0.6.3 or later. This version includes a fix for the unsafe YAML load function. You can update the package by running the command 'pip install --upgrade pyqlib'.
No specific workaround has been provided for this vulnerability. It is recommended to update to the latest version of pyqlib to ensure the vulnerability is addressed.
