CVE-2017-18342

CRITICAL

PyYAML < 5.1 - Remote Code Execution via yaml.load()

Title source: llm
STIX 2.1

Description

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

References (9)

Core 9
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/yaml/pyyaml/pull/74
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/yaml/pyyaml/blob/master/CHANGES
Third Party Advisory x_refsource_misc
https://github.com/marshmallow-code/apispec/issues/278
Third Party Advisory x_refsource_misc
https://github.com/yaml/pyyaml/issues/193
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-45

Scores

CVSS v3 9.8
EPSS 0.0603
EPSS Percentile 92.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (5)
fedoraproject/fedora 28
fedoraproject/fedora 29
fedoraproject/fedora 30
pypi/PyYAML 0 - 4.1PyPI
pyyaml/pyyaml < 5.1
Published Jun 27, 2018
Tracked Since Feb 18, 2026