Homepage

Deserialization of Untrusted Data The advisory has been revoked - it doesn't affect any version of package pyyaml  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
1.06% (85th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Deserialization of Untrusted Data vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU1404-PYYAML-287531
  • published11 Jul 2018
  • disclosed27 Jun 2018
Report a new vulnerability Found a mistake?

Introduced: 27 Jun 2018

CVE-2017-18342  (opens in a new tab)
CWE-502  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pyyaml package and not the pyyaml package as distributed by Ubuntu.

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

References