Quick answers
- Is CVE-2017-18342 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2017-18342 being exploited in the wild.
- How severe is CVE-2017-18342?
- Critical severity, with a CVSS score of 9.8, published 4 January 2019.
- Which products and versions are affected?
- PyYAML (PyPI) < 5.1, ECOSYSTEM:introduced=0,fixed=5.1.
- Is there a fix for CVE-2017-18342?
- Yes. PyYAML (PyPI): upgrade to 5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2017-18342 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2017-18342?
- Check whether you run PyYAML (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- PyYAML (PyPI): upgrade to 5.1 or later
pip install "PyYAML>=5.1"
Technical details
PyYAML versions prior to 5.1 are vulnerable to a deserialization flaw (CWE-502) within the `yaml.load()` API. The root cause is the library's default behavior of allowing the instantiation of arbitrary Python objects during the parsing of YAML data. A remote, unauthenticated attacker can exploit this by providing a specially crafted YAML string that triggers the execution of arbitrary code on the host system. While a fix was attempted in version 4.1, it was yanked due to breaking changes; the vulnerability is fully addressed in version 5.1 by requiring the use of `yaml.safe_load()` or similar secure loaders.
Affected products
- PyYAML PyYAML < 5.1
Identifiers
- CVE-2017-18342
- GHSA-rprw-h62v-c2w7
- PYSEC-2018-49
Timeline
- 2019-01-04: advisory: GitHub Advisory published
- 2019-01-04: patched: Version 5.1 released with the fix