CVE-2017-18342

Advisory

Ores 1.3.1 updates its dependency 'pyyaml' to v4.2b4 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Fixed
* Injection caches can be copied between multiple revisions
* Addresses yaml security issue by bumping dependency version
* ORES client does a better job of closing its socket connections

Added
* Adds documentation about using docker
* ORES client.
* CIDR range support for rate limiting

Changed
* Switch dependency to Flask 1.0
* Remove references to "Objective Revision Evaluation Service" -- it's just "ORES" now.
* Use JSON as celery serializer (increased security)

Removed
* Removed watchdog from precache service. No longer necessary.

Resources

• https://pypi.org/project/ores
• https://pyup.io/changelogs/ores/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342