9.8crit
CVE-2017-18342
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
Also known as GHSA-rprw-h62v-c2w7, PYSEC-2018-49
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
5.6%
percentile 93%
Public exploits
0
none known
Summary
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Exploit prediction (EPSS)
5.57% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | pyyaml | <5.1 | 5.1 |
Classification
- Weakness
- CWE-502 Deserialization of Untrusted Data
References
- github.com /yaml/pyyaml/pull/74 · x_refsource_MISC, x_transferred
- github.com /yaml/pyyaml/blob/master/CHANGES · x_refsource_MISC, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQ · vendor-advisory, x_refsource_FEDORA, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ · vendor-advisory, x_refsource_FEDORA, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQC · vendor-advisory, x_refsource_FEDORA, x_transferred
- github.com /marshmallow-code/apispec/issues/278 · x_refsource_MISC, x_transferred
- github.com /yaml/pyyaml/issues/193 · x_refsource_MISC, x_transferred
- github.com /yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation · x_refsource_MISC, x_transferred
- security.gentoo.org /glsa/202003-45 · vendor-advisory, x_refsource_GENTOO, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-18342 · advisory
- github.com /yaml/pyyaml/issues/207#issuecomment-472520007 · web
- github.com /yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80 · web
- github.com /pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml · web
- github.com /yaml/pyyaml · package
- github.com /yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7S · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7S · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA · web
- github.com /advisories/GHSA-rprw-h62v-c2w7 · advisory
Sources
- CVE List: CVE-2017-18342
- GitHub Advisory: GHSA-rprw-h62v-c2w7
- NVD: CVE-2017-18342
- OSV: PYSEC-2018-49
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.