Bugzilla – Bug 1164458
VUL-0: CVE-2019-20478: python-ruamel.yaml: load method allows remote code execution with an untrusted argument
Last modified: 2022-09-20 12:56:28 UTC
In ruamel.yaml through 0.16.7, the load method allows remote code execution if
the application calls this method with an untrusted argument. In other words,
this issue affects developers who are unaware of the need to use methods such as
safe_load in these use cases.
note: version 0.15.+ has api change in load/dump
For SUSE:SLE-12:Update, a mitigation is better than an version update.
The 'safe_load' method from python-ruamel.yaml v0.12.14 is always preferred over the 'load' method. Using 'safe_load' will prevent RCE by an insecure deserialization.
The other codestreams are fixed, closing