CVE-2017-18342: Input Validation
In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safeload is not used.
Other sources
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
It was found that using yaml.load() API on untrusted input could lead to arbitrary code execution.
References:
http://seclists.org/oss-sec/2018/q2/240
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-18342?
CVE-2017-18342 is a vulnerability in PyYAML that allows arbitrary code execution.
How severe is CVE-2017-18342?
CVE-2017-18342 has a severity rating of 9.8, which is considered critical.
Which versions of PyYAML are affected by CVE-2017-18342?
Versions up to and including 4.1 of PyYAML are affected by CVE-2017-18342.
How can I fix CVE-2017-18342?
To fix CVE-2017-18342, you should upgrade to version 5.1 or newer of PyYAML.
Where can I find more information about CVE-2017-18342?
You can find more information about CVE-2017-18342 at the following references: [link1], [link2], [link3].