CVE-2017-18342: PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
Summary
CVE-2017-18342: PyYAML insecurely deserializes YAML strings leading to arbitrary code execution. Affects pyyaml versions < 4.1. Fixed in 4.1. How to fix ↓
Also tracked for
- pyyaml · Debian:11
The same CVE-2017-18342 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyYAML is a Python library that allows developers to parse and manipulate YAML (YAML Ain't Markup Language) files. It provides functionality for loading YAML data into Python objects and vice versa. PyYAML is widely used in various Python projects and applications.
Vulnerability Detail
The vulnerability (CVE-2017-18342) in PyYAML versions before 4.1 arises from the insecure deserialization of YAML strings. The yaml.load() API, which is used to load YAML data, can execute arbitrary code. This means that an attacker can craft a malicious YAML file that, when loaded using yaml.load(), can lead to arbitrary code execution on the system. The safe_load() function, which is intended to load YAML data safely, is not used, exacerbating the issue. The vulnerability has a CVSS score of 9.8 (Critical severity) according to the CVSS v3.1 scoring system.
How To Fix
Minimum fixed version
4.1
This is the first release that contains the fix.
pip install --upgrade "pyyaml==4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can use the safe_load() function instead of yaml.load() to load YAML data. safe_load() is designed to mitigate the risk of code execution by only allowing the deserialization of simple Python objects. However, it is still recommended to upgrade to the latest version of PyYAML to fully address the vulnerability.
Conclusion
In conclusion, the CVE-2017-18342 vulnerability in PyYAML allows for the insecure deserialization of YAML strings, leading to arbitrary code execution. It is crucial to upgrade to PyYAML version 4.1 or later to mitigate this vulnerability. Developers should also consider using the safe_load() function as a temporary workaround until the upgrade can be applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is a Python library for parsing and manipulating YAML files.
The vulnerability allows an attacker to execute arbitrary code by crafting a malicious YAML file.
Upgrade PyYAML to version 4.1 or later.
Developers can use the safe_load() function instead of yaml.load() as a temporary workaround.
The vulnerability has a CVSS score of 9.8 (Critical severity).
References
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
