Описание
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | |
| cosmic | ignored | end of life |
| devel | not-affected | 5.1.2-1 |
| disco | ignored | end of life |
| eoan | not-affected | 5.1.2-1 |
| esm-infra-legacy/trusty | ignored | |
| esm-infra/bionic | ignored | |
| esm-infra/focal | not-affected | 5.1.2-1 |
| esm-infra/xenial | ignored | |
| focal | not-affected | 5.1.2-1 |
Показывать по
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code ...
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
Уязвимость компонента yaml.load() библиотеки парсинга YAML для Python PyYAML, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3