CVE-2017-18342

Advisory

Pgbedrock 0.4.2 includes a security patch for the function 'load_spec' in 'pgbedrock/spec_inspector.py'. It used the unsafe yaml.load() that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/Squarespace/pgbedrock/commit/a217fa419fbb88fd4949ea6db7ca2fa9869cf8e1

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Pgbedrock version 0.4.2 includes a security patch for the function 'load_spec' in 'pgbedrock/spec_inspector.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/Squarespace/pgbedrock/commit/a217fa419fbb88fd4949ea6db7ca2fa9869cf8e1

Resources

• https://pypi.org/project/pgbedrock
• https://pyup.io/changelogs/pgbedrock/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342