Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bump PyYAML to 5.1 for CVE-2017-18342 #69

Merged
merged 2 commits into from
Mar 22, 2019
Merged

bump PyYAML to 5.1 for CVE-2017-18342 #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
97ef57e
bump PyYAML to 5.1 for CVE-2017-18342
dtkav Mar 15, 2019
f21bd0e
Revert "add security note"
dtkav Mar 15, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 0 additions & 15 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,21 +69,6 @@ from openapi_spec_validator import openapi_v3_spec_validator
errors_iterator = openapi_v3_spec_validator.iter_errors(spec)
```

## Security Note

PyYAML, a requirement of this project, has a
[security vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2017-18342)
in the default implementation of `yaml.load()`, which allows execution
of arbitrary code while loading a target file or stream. OpenAPI Spec
Validator uses a safe loader to ensure that only Python objects
marked as safe can be executed. Thus, you are not exposed to this
vulnerability by using this package.

If you use `PyYAML` directly, be sure to use `yaml.safe_load()` to
avoid inadvertantly exposing youself to potentially malicous data. The
[PyYAML docs](https://pyyaml.org/wiki/PyYAMLDocumentation#loading-yaml)
describe this issue in detail.

## Related projects

* [openapi-core](https://github.com/p1c2u/openapi-core) is a Python library that adds client-side and server-side support for the OpenAPI.
Expand Down
2 changes: 1 addition & 1 deletion setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ def run_tests(self):
},
install_requires=[
"jsonschema<3",
"PyYAML>=3.13",
"PyYAML>=5.1",
"six",
'pathlib2;python_version=="2.7"',
],
Expand Down