CVE-2017-18342

Advisory

Oci-cli 2.6.3 fixes CVE-2017-18342. In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------
Added
~~~~~
* Support for kms encryption of file system in the File Storage Service.

* ``oci fs file-system create --kms-key-id``
* ``oci fs file-system update --kms-key-id``

* Support for an option to set up archiving to Object Storage in the Streaming Service.

* ``oci streaming admin archiver``

* Support for interacting with the resource limits of a specific resource type in the Limits Service.

* ``oci limits definition list``
* ``oci limits resource-availability get``
* ``oci limits service list``
* ``oci limits value list``

* Support for ETag on Streaming Resources.

* ``oci streaming admin stream delete --if-match``
* ``oci streaming admin stream update --if-match``

* Support for change of compartments for Public IP, Dhcp Options, Local Peering Gateway, Internet Gateway, Network Security Group (nsg) resources in the Networking Service.

* oci network internet-gateway change-compartment --compartment-id, --ig-id
* oci network dhcp-options change-compartment --compartment-id, --dhcp-id
* oci network local-peering-gateway change-compartment --compartment-id, --local-peering-gateway-id
* oci network nsg change-compartment --compartment-id, --nsg-id
* oci network public-ip change-compartment --compartment-id, --public-ip-id

* Support for AddressLists resource management in the WAF Policy Service:

* ``oci waas address-list``

* Support for clearing cached resources in Edge nodes in the WAF Policy Service.

* ``oci waas purge-cache --waas-policy-id, --resources``

* Support for Cache control in WAF Policy Service

* ``oci waas caching-rule list``
* ``oci waas caching-rule update``

* Support for Custom Protection Rule resource management in the WAF Policy Service.

* ``oci waas customer-protection-rule``
* ``oci waas waas-policy custom-protection-rule list``

* Improve support for WAF Policy settings by introducing new options in the WAF Policy Service.

* ``oci waas policy-config update --cipher-group, --client-address-header, --force, --is-behind-cdn, --is-cache-control-respected, --is-origin-compression-enabled, --is-response-buffering-enabled, --tls-protocols``

* Improve support for WAF Policy by introducing custom-protection-rule usage configuration in the WAF Policy Service.

* ``oci waas waas-policy custom-protection-rule list --waas-policy-id, --action, --all-pages, --mod-security-rule-id``

* Improve support for WAF Policy sercice by introducing new Origin Groups option in the WAF Policy Service.

* ``oci waas waas-policy create --origin-groups``
* ``oci waas waas-policy update --origin-groups``

* Improve support for WAF config in WAF Policy service by introducing options for caching-rules, custom-protection-rules and origin-groups in the WAF Policy Service.

* ``oci waas waf-config update --caching-rules, --custom-protection-rules, --origin-groups``

* Launching database system with --auto-backup-enabled and --recovery-window-in-days options in the Database Service.

* ``oci db system launch --auto-backup-enabled and --recovery-window-in-days``

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342
• https://github.com/yaml/pyyaml/pull/74
• https://github.com/yaml/pyyaml/blob/master/CHANGES
• https://lists.fedoraproject.org/archives/list/[email protected]/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
• https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
• https://github.com/marshmallow-code/apispec/issues/278
• https://github.com/yaml/pyyaml/issues/193
• https://security.gentoo.org/glsa/202003-45