CVE-2017-18342

Name of the Vulnerable Software and Affected Versions PyYAML versions prior to 5.1

Description The issue is related to the yaml.load() API, which could execute arbitrary code if used with untrusted data. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function. The estimated number of potentially affected devices worldwide is not available.

Recommendations For PyYAML versions prior to 5.1, consider using the yaml.safe load() function instead of yaml.load() to prevent arbitrary code execution. As a temporary workaround, consider disabling the yaml.load() function until a patch is available. Restrict access to untrusted data to minimize the risk of exploitation.