cybersecurity threat CVE-2017-18342

PyYAML: code execution via yaml.load

Synthesis of the vulnerability

An attacker can use a vulnerability via yaml.load() of PyYAML, in order to run code.
Severity of this announce: 2/4.
Creation date: 21/03/2019.
Références of this computer vulnerability: bulletinjul2019, CVE-2017-18342, FEDORA-2019-bed9afe622, VIGILANCE-VUL-28801.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can use a vulnerability via yaml.load() of PyYAML, in order to run code.
Full Vigil@nce bulletin... (Free trial)

This computer threat note impacts software or systems such as Fedora, Solaris.

Our Vigil@nce team determined that the severity of this weakness alert is medium.

The trust level is of type confirmed by the editor, with an origin of document.

An attacker with a expert ability can exploit this computer weakness note.

Solutions for this threat

Fedora 29: new PyYAML packages.
New packages are available:
Fedora 29: PyYAML 5.1-1.fc29

Oracle Solaris: patch for third party software of July 2019 v1.
A patch is available:
https://support.oracle.com/rs?type=doc&id=1448883.1
Full Vigil@nce bulletin... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a cybersecurity database. The technology watch team tracks security threats targeting the computer system. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system.