CVE-2017-18342

Advisory

Abiflows 0.6 includes a security patch for the function 'test_abipy_manager_from_file' in 'abiflows/fireworks/utils/tests/test_fw_utils.py'. It used the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/abinit/abiflows/commit/479b957c3b1abe41d85aaff2d14439605ddc5d0b#diff-5a814c49249ffdc2d551933c1bec95c4b2fe64d0619470085c5fef247fea2309

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Abiflows version 0.6 includes a security patch for the function 'test_abipy_manager_from_file' in 'abiflows/fireworks/utils/tests/test_fw_utils.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/abinit/abiflows/commit/479b957c3b1abe41d85aaff2d14439605ddc5d0b#diff-5a814c49249ffdc2d551933c1bec95c4b2fe64d0619470085c5fef247fea2309

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342