What’s Vulnerable › Vulnerabilities

CVE-2017-18342

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-27 · updated 2026-06-17
• Weakness: CWE-502

Description

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

Affected products

• Fedoraproject Fedora: 28, 29, 30
• Pyyaml: before 5.1 — fixed in 5.1

How to fix

Upgrade to a fixed version: Pyyaml 5.1. Check the vendor advisory for mitigations.

References

• https://github.com/marshmallow-code/apispec/issues/278
• https://github.com/yaml/pyyaml/blob/master/CHANGES
• https://github.com/yaml/pyyaml/issues/193
• https://github.com/yaml/pyyaml/pull/74
• https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/
• https://security.gentoo.org/glsa/202003-45
• https://github.com/marshmallow-code/apispec/issues/278
• https://github.com/yaml/pyyaml/blob/master/CHANGES
• https://github.com/yaml/pyyaml/issues/193

Get alerted when CVE-2017-18342 or the next vulnerability affects your stack