CVE-2017-18342

Advisory

Pytoolbox 14.0.0 includes a security patch for the function 'load_metadata' in 'pytoolbox/juju.py'. It used the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/davidfischer-ch/pytoolbox/commit/748250794514681c0ef8725047a5da4dd9d8a7fd#diff-70bec318e5ce058eed29fb35ad6b97d24ece119b0a51b7f1cdb5a064a4bf5b6b

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Pytoolbox version 14.0.0 includes a security patch for the function 'load_metadata' in 'pytoolbox/juju.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/davidfischer-ch/pytoolbox/commit/748250794514681c0ef8725047a5da4dd9d8a7fd#diff-70bec318e5ce058eed29fb35ad6b97d24ece119b0a51b7f1cdb5a064a4bf5b6b

Resources

• https://pypi.org/project/pytoolbox
• https://pyup.io/changelogs/pytoolbox/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342