670
VMScore

CVE-2017-18342

Published: 27/06/2018 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 670
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

In PyYAML prior to 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

pyyaml pyyaml

fedoraproject fedora 28

fedoraproject fedora 29

fedoraproject fedora 30

Vendor Advisories

Debian Bug report logs - #902878 pyyaml: CVE-2017-18342 Package: src:pyyaml; Maintainer for src:pyyaml is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 2 Jul 2018 17:45:02 UTC Severity: normal Tags: fixed-upstream, security, ...
In PyYAML before 41, the yamlload() API could execute arbitrary code In other words, yamlsafe_load is not used ...
In PyYAML before 41, the yamlload() API could execute arbitrary code In other words, yamlsafe_load is not used ...
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS ...

Github Repositories

Simiki Simiki is a simple wiki framework, written in Python Easy to use Creating a wiki only needs a few steps Use Markdown Just open your editor and write Store source files by category Static HTML output A CLI tool to manage the wiki Simiki is short for Simple Wiki :) New in version 1623 (2019-05-11) Fix Issue #124 New in version 1622 (2019-04-21) Fix PyYAM

Simiki is a simple wiki framework, written in Python.

Simiki Simiki is a simple wiki framework, written in Python Easy to use Creating a wiki only needs a few steps Use Markdown Just open your editor and write Store source files by category Static HTML output A CLI tool to manage the wiki Simiki is short for Simple Wiki :) New in version 1623 (2019-05-11) Fix Issue #124 New in version 1622 (2019-04-21) Fix PyYAM

Beginners technical talk with examples on the different data types for cross language/platform communication

talk-yaml-json-xml-oh-my Beginners technical talk with examples on the different data types for cross language/platform communication Introduction The Bay Area Python Interest Group (BAyPIGgies) wanted to revive their "newbie nugget" -- small snippets of information for beginners so that everyone in the audience can walk away with some knowledge They asked me if I co

intercom_test

The intercom_test Package This package provides Python tools to facilitate Interface by Example programming Test case data is stored in YAML to provide the widest possible access by tools and programming languages while still being friendly to the humans who often need to manually manipulate it Package documentation is available at Read the Docs Interface by Example Integrat

Distributed HTTP load testing platform on AWS, based on https://locust.io/.

HTTP Load Testing on AWS with Locust Set up a basic, stateless, distributed HTTP load testing platform on AWS, based on Locust: Define user behaviour with Python code, and swarm your system with millions of simultaneous users For more information on the format of the Python code which specifies the load test, see "Writing a locustfile" Attribution This setup is he

GRPC deployment server sandbox project

deployment-server Archived This repository is no longer maintained, so please use any of the code at your own discretion The outdated PyYAML dependency in the project contains a potential security vulnerability CVE-2017-18342 so please patch if you decide to use this code for something Description This is a sandbox project I created for learning purposes I've built it a

DevSecOps workflow description For purpose of this technical assignement we use DVPWA app DVPWA is an intentionally vulnerable application This repo is a clone of DVPWA and is used for devsecops workflow technical challenges For SAST and SCA analysis of the code, we use Horusec open-source tool In this case, we use only CLI, which is not integrated with web UI of Horusec T

A collection of pre-commit hooks I use in most of my repositories.

pre-commit-hooks This is a collection of hooks that I use quite broadly Install create pre-commit-configyaml in you git project with the following included: --- repos: - repo: githubcom/danielhoherd/pre-commit-hooks rev: master hooks: - id: CVE-2017-18342 - id: remove-unicode-zero-width-non-breaking-spaces - id: remove-unicode-zero-width