Red Hat Bugzilla – Bug 1595743
CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
Last modified: 2018-10-23 05:47:36 EDT
It was found that using yaml.load() API on untrusted input could lead to arbitrary code execution. References: http://seclists.org/oss-sec/2018/q2/240
Created PyYAML tracking bugs for this issue: Affects: fedora-all [bug 1595744] Created python2-pyyaml tracking bugs for this issue: Affects: epel-all [bug 1595745] Created python3-PyYAML tracking bugs for this issue: Affects: epel-all [bug 1595746]
Pull request: https://github.com/yaml/pyyaml/pull/74
PyYAML should be updated to >= 4.1, where `yaml.load()` has been changed to call `yaml.safe_load()`.
Note that the EPEL python2-pyyaml package doesn't contain anything at all. It just depends on the RHEL python-pyyaml package, and allows packagers to use dependencies on python2-pyyaml on all releases.
Also note that the fact that yaml.load() is not safe has been known for centuries, so please don't rush with this fix: * the fix changes API very much (even nonobviously [1]) * the released version 4.1 was removed from PyPI, causing troubles [2] [1] https://github.com/yaml/pyyaml/issues/187 [2] https://github.com/yaml/pyyaml/issues/192
Changing the severity to Moderate, as previously noted the lack of safety in `yaml.load()` has been known for a considerable time.
Statement: PyYAML in channels for Red Hat MRG Messaging 2 should no longer be used, as a newer version is now available in Red Hat Enterprise Linux. Newer packages should be consumed from Red Hat Enterprise Linux channels. This issue affects the versions of the PyYAML package as shipped with Red Hat Satellite 5. However, this flaw is not known to be exploitable under any supported scenario in Satellite 5. A future update may address this issue.
The [upstream documentation] says: > Warning: It is not safe to call yaml.load with any data received from an untrusted source! yaml.load is as powerful as pickle.load and so may call any Python function. Check the yaml.safe_load function though. This has been known since around 2013 (see e.g. [0]). However, it's part of a stable API, so it's not easy to change. The 4.1 release, which fixes this, was recalled by upstream. So, there currently is no upstream fix released for the CVE. [upstream documentation]: https://pyyaml.org/wiki/PyYAMLDocumentation#loading-yaml [0]: https://nedbatchelder.com/blog/201302/war_is_peace.html