CVE-2017-18342

Advisory

Python-Coveralls 2.9.3 includes a security patch for the function 'parse_args' in 'coveralls/init.py'. It used the unsafe yaml.load(), that allows instantiation of arbitrary objects. Consider yaml.safe_load().
https://github.com/z4r/python-coveralls/commit/cb798698f3d6ef120e6d6ff87d4d4a0e239d8c85#diff-82a6c0a53e21b94154c2c4ec0c9c76370e6e9d4305c551b8e70c82add2030db1

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Python-Coveralls version 2.9.3 includes a security patch for the function 'parse_args' in 'coveralls/init.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/z4r/python-coveralls/commit/cb798698f3d6ef120e6d6ff87d4d4a0e239d8c85#diff-82a6c0a53e21b94154c2c4ec0c9c76370e6e9d4305c551b8e70c82add2030db1

Resources

• https://pypi.org/project/python-coveralls
• https://pyup.io/changelogs/python-coveralls/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342