CVE-2017-18342

Advisory

Pymls 1.4.10 fixes the Github-reported security issues in requirements.txt and bumps PyYAML version in setup for security reasons (CVE-2017-18342).

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Changed

- The handling of rigid backing condition has been improved for PEM (the
previous one would give inaccurate results in some cases)

Fixed

- Github-reported security issues in requirements.txt
- Bumped PyYAML version in setup for security reasons (CVE-2017-18342)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342
• https://github.com/yaml/pyyaml/pull/74
• https://github.com/yaml/pyyaml/blob/master/CHANGES
• https://lists.fedoraproject.org/archives/list/[email protected]/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
• https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
• https://github.com/marshmallow-code/apispec/issues/278
• https://github.com/yaml/pyyaml/issues/193
• https://security.gentoo.org/glsa/202003-45