CVE-2017-18342

Advisory

Ml-Versioning-Tools 2.0.1 includes a security patch for the function 'get_dvc_meta' in 'mlvtools/mlv_dvc/dvc_parser.py'. It used the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/peopledoc/mlvtools/commit/8a18faaea26c0fc93dad15f03b8e9b81473a4120

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Ml-Versioning-Tools version 2.0.1 includes a security patch for the function 'get_dvc_meta' in 'mlvtools/mlv_dvc/dvc_parser.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/peopledoc/mlvtools/commit/8a18faaea26c0fc93dad15f03b8e9b81473a4120

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342