CVE-2017-18342

Advisory

Viscid version 1.0.0 includes a security patch for the function 'plot_opts_to_kwargs' in 'viscid/plot/vpyplot.py'. It uses the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/viscid-hub/Viscid/commit/892052a5c12aa7aa865de277945c55defcc7e9f7

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Viscid version 1.0.0 includes a security patch for the function 'plot_opts_to_kwargs' in 'viscid/plot/vpyplot.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/viscid-hub/Viscid/commit/892052a5c12aa7aa865de277945c55defcc7e9f7

Resources

• https://pypi.org/project/viscid
• https://pyup.io/changelogs/viscid/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342