CVE-2017-18342
Fixed in a distro release EPSS 6%
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Products: pyyaml, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyyaml | 5.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | python-yaml | 5.1-1 |
| Debian 12 | pyyaml | 5.1.2-1 |
| Debian 13 | pyyaml | 5.1.2-1 |
| Debian 14 | pyyaml | 5.1.2-1 |
| Ubuntu 14.04 LTS | pyyaml | no fix |
| Ubuntu 16.04 LTS | pyyaml | no fix |
| Ubuntu 18.04 LTS | pyyaml | no fix |
| openSUSE Tumbleweed | oci-cli | 3.0.2-1.2 |
| openSUSE Tumbleweed | python-PyYAML | 6.0.1-4.1 |
| openSUSE Tumbleweed | python-PyYAML | 6.0.3-1.6 |
| openSUSE Tumbleweed | python-PyYAML | 5.4.1-1.6 |
| openSUSE Tumbleweed | python-openapi-spec-validator | 0.9.0-1.1 |
| openSUSE Tumbleweed | python-openapi-spec-validator | 0.7.1-1.3 |