CVE-2017-18342

Advisory

Credstash 1.16.0 updates its dependency pyyaml to a version >=4.2b1 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* New: freddyVandalay added a programmatic way to autoversion: `putSecretAutoversion`
* New: corrjo added the ability to tag the `credstash` DDB table using `credstash setup --tags Tag=Value`
* New: alkersan added the ability to specify the `credstash` DDB table using an environment variable
* New: cheethoe added the ability to pass custom dynamodb/kms sessions to `putSecret`
* Bugfix: dbanttari fixed large deletes and made them more efficient by using `query` instead of `scan`
* Bugfix: Update to pyyaml>=4.2b1 due to security vulnerability in older versions
* Added basic integration tests

Resources

• https://pypi.org/project/credstash
• https://pyup.io/changelogs/credstash/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342