CVE-2017-18342

Advisory

Ortec.scientific.benchmarks.loadbuilding 1.0.1 includes a security patch for the function 'safeFindRoot' in 'ortec/scientific/benchmarks/loadbuilding/solution/read/YAMLtoThreeDsolution.py'. It used the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/ORTECScientificBenchmarks/ortec-scientific-benchmarks-loadbuilding/commit/81b5f1ad38bc25ddf8ce1e988cb540a8d7f43482

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Ortec.scientific.benchmarks.loadbuilding version 1.0.1 includes a security patch for the function 'safeFindRoot' in 'ortec/scientific/benchmarks/loadbuilding/solution/read/YAMLtoThreeDsolution.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/ORTECScientificBenchmarks/ortec-scientific-benchmarks-loadbuilding/commit/81b5f1ad38bc25ddf8ce1e988cb540a8d7f43482

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342