CVE-2017-18342: PyYAML Arbitrary Code Execution
Summary
CVE-2017-18342: In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. Affects pyyaml versions < 5.1. Fixed in 5.1. How to fix ↓
Also tracked for
- pyyaml · Debian:11
The same CVE-2017-18342 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyYAML is a Python library that allows parsing and emitting YAML files. It provides a way to represent data in a human-readable format. PyYAML is widely used in various Python applications and frameworks for handling YAML files. However, prior to version 5.1, PyYAML's yaml.load() API had a vulnerability that could allow the execution of arbitrary code when used with untrusted data. This vulnerability has been assigned the CVE identifier CVE-2017-18342.
Vulnerability Detail
The vulnerability in PyYAML arises from the load() function, which was deprecated in version 5.1. When using the deprecated load() function with untrusted data, an attacker could craft malicious YAML files that execute arbitrary code during the parsing process. This could lead to remote code execution and potential compromise of the system. To address this issue, PyYAML introduced the 'UnsafeLoader' in version 5.1, which is provided for backward compatibility with the deprecated load() function.
How To Fix
Minimum fixed version
5.1
This is the first release that contains the fix.
pip install --upgrade "pyyaml==5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading PyYAML is not immediately feasible, a possible workaround is to avoid using the deprecated load() function altogether and instead use the 'SafeLoader' or 'FullLoader' provided by PyYAML. These loaders are not affected by the vulnerability and can be used as alternatives to safely parse YAML files. Here is an example of using the 'SafeLoader':
import yaml
with open('file.yaml', 'r') as f:
data = yaml.load(f, Loader=yaml.SafeLoader)
Conclusion
In conclusion, PyYAML versions prior to 5.1 are vulnerable to arbitrary code execution when using the deprecated load() function with untrusted data. Upgrading to version 5.1 or later and using the 'UnsafeLoader' is the recommended solution. Alternatively, the 'SafeLoader' or 'FullLoader' can be used as workarounds. It is important to validate and sanitize YAML data from untrusted sources to mitigate the risk of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is a Python library for parsing and emitting YAML files. It provides a way to represent data in a human-readable format.
The vulnerability in PyYAML could allow an attacker to execute arbitrary code when parsing malicious YAML files. This could lead to remote code execution and potential compromise of the system.
Versions of PyYAML prior to 5.1 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade PyYAML to version 5.1 or later and replace the deprecated load() function with the 'UnsafeLoader'. It is also important to validate and sanitize any YAML data from untrusted sources.
If upgrading PyYAML is not immediately feasible, you can use the 'SafeLoader' or 'FullLoader' provided by PyYAML as alternatives to the deprecated load() function. These loaders are not affected by the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
