logo

Database

Insecure deserialization In python-yaml

Description

arbitrary code execution

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2017-183422. NVD-2017-183423. OSV-DEBIAN-2017-183424. OSV-2017-183425. GCVE-2017-183426. SECURITY-TRACKER-CVE-2017-183427. security.gentoo.org

References

1. https://github.com/marshmallow-code/apispec/issues/2782. https://github.com/yaml/pyyaml/issues/1933. https://github.com/yaml/pyyaml/issues/207#issuecomment-4725200074. https://github.com/yaml/pyyaml/pull/745. https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be806. https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml7. https://github.com/yaml/pyyaml/blob/master/CHANGES8. https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation9. https://lists.fedoraproject.org/archives/list/[email protected]/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ10. https://lists.fedoraproject.org/archives/list/[email protected]/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE11. https://lists.fedoraproject.org/archives/list/[email protected]/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.