Joined: 12 May 2004
|Posted: Thu Mar 19, 2020 11:26 pm Post subject: [ GLSA 202003-45 ] PyYAML
|Gentoo Linux Security Advisory
Title: PyYAML: Arbitrary code execution (GLSA 202003-45)
Exploitable: local, remote
A flaw in PyYAML might allow attackers to execute arbitrary code.
PyYAML is a YAML parser and emitter for Python.
Vulnerable: < 5.1
Unaffected: >= 5.1
Architectures: All supported architectures
It was found that using yaml.load() API on untrusted input could lead to
arbitrary code execution.
A remote attacker could entice a user to process specially crafted input
in an application using yaml.load() from PyYAML, possibly resulting in
execution of arbitrary code with the privileges of the process or a
Denial of Service condition.
There is no known workaround at this time.
All PyYAML users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/pyyaml-5.1"