CVE-2017-18342

Advisory

Selenible version 0.0.4 includes a security patch for the function 'Base_var_from' in 'selenible/modules/ctrl.py'. It used the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/wtnb75/selenible/commit/4e53114278475d94dd0c98fd6dbf41806b2c1c98

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Selenible version 0.0.4 includes a security patch for the function 'Base_var_from' in 'selenible/modules/ctrl.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/wtnb75/selenible/commit/4e53114278475d94dd0c98fd6dbf41806b2c1c98

Resources

• https://pypi.org/project/selenible
• https://pyup.io/changelogs/selenible/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342