CVE-2018-18074

Advisory

Shub 2.10.0 upgrades its pyyaml dependency from version 3.12 to 5.1.1, addressing the security vulnerability CVE-2018-18074.
https://github.com/scrapinghub/shub/pull/353/commits/0ba5d4aeefe11044f5d218ddcf85511fcde29633

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Changes:

- add a new `shub cancel` command to cancel multiple jobs at once (359)
- add `--no-cache` flag to ignore cache when building an image locally (351)
- add `--reauth` flag to re-authenticate when pushing an image to a registry (365)
- ensure that `--insecure` can't be used along with user credential parameters (321)
- fix the last character of the stream log when building an image (361)
- remove intermediate containers after a successful image build (367)
- update a few dependencies to address known security vulnerabilities (353)
- drop official support of Python 3.4
- development improvements and minor fixes

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074