Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Testsuite is using yaml.load CVE-2017-18342 #191

Closed
atupone opened this issue Jun 9, 2019 · 2 comments
Closed

Testsuite is using yaml.load CVE-2017-18342 #191

atupone opened this issue Jun 9, 2019 · 2 comments

Comments

@atupone
Copy link
Contributor

atupone commented Jun 9, 2019

In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.
I don't know the status after 4.1, however in gentoo with pyyaml 5.1 I cannot run test for the yaml.load() use
@pmderodat
Copy link
Member

Hello @atupone

Thank you for raising this issue. The testsuite should work with .safe_load: we’ll test this option and will update our Python codebase accordingly.

pmderodat added a commit to pmderodat/langkit that referenced this issue Jun 10, 2019
@pmderodat
testsuite/polyfill: use yaml.safe_load instead of yaml.load
21100df 
For GitHub issue AdaCore#191
pmderodat added a commit to pmderodat/libadalang that referenced this issue Jun 10, 2019
@pmderodat
testsuite/polyfill: use yaml.safe_load instead of yaml.load
9bf4de4 
For GitHub issue AdaCore/langkit#191
pmderodat added a commit to AdaCore/libadalang that referenced this issue Jun 10, 2019
@pmderodat
testsuite/polyfill: use yaml.safe_load instead of yaml.load
ca5603b 
For GitHub issue AdaCore/langkit#191
pmderodat added a commit that referenced this issue Jun 10, 2019
@pmderodat
testsuite/polyfill: use yaml.safe_load instead of yaml.load
a62a774 
For GitHub issue #191
@pmderodat
Copy link
Member

This is now fixed. Thanks again for reporting this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@pmderodat @atupone