CVE-2017-18342

Advisory

Database-Sanitizer 1.1.0 includes a security patch for the function 'from_file' in 'database_sanitizer/config.py'. It used the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/andersinno/python-database-sanitizer/commit/ace4e0823d7b81c6f3bf683eb97193b36cc6c040#diff-6090be0559642595d2ff5ff2e9d265c6d152a75ef98845380436d0f06e0b3c19

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Database-Sanitizer version 1.1.0 includes a security patch for the function 'from_file' in 'database_sanitizer/config.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/andersinno/python-database-sanitizer/commit/ace4e0823d7b81c6f3bf683eb97193b36cc6c040#diff-6090be0559642595d2ff5ff2e9d265c6d152a75ef98845380436d0f06e0b3c19

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342