Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:0959-1

Опубликовано: 08 апр. 2020
Источник: suse-cvrf

Описание

Security update for python-PyYAML

This update for python-PyYAML fixes the following issues:

  • CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader (bsc#1165439).

Список пакетов

Container caasp/v4/k8s-sidecar:0.1.75
python3-PyYAML-5.1.2-6.6.1
Container ses/6/cephcsi/cephcsi:latest
python3-PyYAML-5.1.2-6.6.1
Container ses/6/rook/ceph:latest
python3-PyYAML-5.1.2-6.6.1
Container ses/7/ceph/ceph:latest
python3-PyYAML-5.1.2-6.6.1
Container ses/7/cephcsi/cephcsi:latest
python3-PyYAML-5.1.2-6.6.1
Container ses/7/prometheus-webhook-snmp:latest
python3-PyYAML-5.1.2-6.6.1
Container ses/7/rook/ceph:latest
python3-PyYAML-5.1.2-6.6.1
SUSE Linux Enterprise Module for Basesystem 15 SP1
python3-PyYAML-5.1.2-6.6.1
SUSE Linux Enterprise Module for Python 2 15 SP1
python2-PyYAML-5.1.2-6.6.1

Ссылки

Описание

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Затронутые продукты
Container caasp/v4/k8s-sidecar:0.1.75:python3-PyYAML-5.1.2-6.6.1
Container ses/6/cephcsi/cephcsi:latest:python3-PyYAML-5.1.2-6.6.1
Container ses/6/rook/ceph:latest:python3-PyYAML-5.1.2-6.6.1
Container ses/7/ceph/ceph:latest:python3-PyYAML-5.1.2-6.6.1
Ссылки