Make pyyaml safe by default. by alex · Pull Request #74 · yaml/pyyaml

alex · 2017-08-26T13:27:35Z

Change yaml.load/yaml.dump to be yaml.safe_load/yaml.safe_dump, introduced yaml.danger_dump/yaml.danger_load, and the same for various other classes.

(python2 only at this moment)

Fixes #5

Change yaml.load/yaml.dump to be yaml.safe_load/yaml.safe_dump, introduced yaml.danger_dump/yaml.danger_load, and the same for various other classes. (python2 only at this moment) Refs yaml#5

alex · 2017-08-26T13:35:07Z

@sigmavirus24 I'd appreciate feedback on whether this looks correct to you -- and if it needs anything more.

Once the py2 version looks good I'll apply the changes to the py3k versions of the code.

sigmavirus24 · 2017-08-26T13:47:13Z

Go ahead with the Python 3 versions of the code. 🎉

KevinHock · 2018-06-26T23:08:03Z

You are the greatest @alex

hydrosquall · 2018-06-27T03:55:32Z

This is a fantastic change! Probably the highlight of 4.1 in my opinion. I hadn't realized the danger of vanilla load until it was featured in a Python security holes article earlier this month (https://hackernoon.com/10-common-security-gotchas-in-python-and-how-to-avoid-them-e19fbe265e03). I never thought to look for safe_load since I was viewing this as a drop-in replacement for json.load.

KevinHock · 2018-06-27T06:17:23Z

This is the changelog https://github.com/yaml/pyyaml/blob/master/CHANGES

alex · 2018-06-27T12:02:51Z

Thanks all. FYI, this issue was assigned CVE-2017-18342.

jezdez · 2018-06-28T13:50:31Z

@alex 😻

Revert "Make pyyaml safe by default." This reverts commit bbcf95f. This reverts commit 7b68405. This reverts commit 517e83e.

- known vulnerability in version <4.1 [1] [1] yaml/pyyaml#74

@asomov

Alex Gaynor (4): Make pyyaml safe by default. wtf, how did this typo happen Now, for py3k! Changes for 4.1 release Andrey Somov (1): Remove redundant code in Scanner.peek_token() Anthony Sottile (1): Install cython alongside tox Daniel Beer (1): Allow colon in a plain scalar in a flow context (#45) Donald Stufft (4): Add a tox.ini to run tests Ignore common build/runtime artifacts Add Travis Support Fallback to Pure Python if Compilation fails Florian Bruhin (1): Import Hashable from collections.abc Hugo (1): Test on Python 3.7-dev Ian Cordasco (1): Install tox in a virtualenv Ingy döt Net (6): Revert PR #150 per @asomov Changes for 4.01 release Reverting yaml/pyyaml#74 Deprecate/warn usage of yaml.load(input) Update .travis.yml to use libyaml 0.2.2 Updates for 5.1 release Jakub Wilk (1): Fix typos Jon Dufresne (5): Document and test Python 3.6 support Use Travis CI built in pip cache support Remove tox workaround for Travis CI Remove commented out Psyco code Include license file in the generated wheel package Kirill Simonov (1): Added tag 3.12 for changeset 823acfc7b4ff Matt Davis (2): Squash/merge pull request #105 from nnadeau/patch-1 Windows Appveyor build Peter Murphy (5): A change to a message First attack at pyyaml does not support literals in unicode over codepoint 0xffff #25 Added emoticon test data files (which will probably break testing) Suspicious 'expected an exception' messages trimmed Reverting README to old copy Timofei Bondarev (1): Improve RepresenterError creation Tina Müller (7): Support escaped slash in double quotes "\/" Force cython when building sdist Build libyaml on travis Apply FullLoader/UnsafeLoader changes to lib3 Allow to turn off sorting keys in Dumper Make default_flow_style=False Skip certain unicode tests when maxunicode not > 0xffff hsmtkk (1): add 3.12 changelog hugovk (1): Drop unsupported Python 3.3 psanchez (1): Resolves #57, update readme issues link scauligi (1): Fix for bug yaml/pyyaml#118

* Add the utf-8 byte order marker to simplify issues with loading to Excel * Brought tests suites inline with models.py, handle the utf-8 BOM, and expect bytes over the wire. * Whoops. params where they should have been. * Minor changes to cache invalidation to get rid of write access rqmt. * ugh tests. * get_cache should be type-hinting a str return, not bool. Also, I was returning both a datetime, or a str. Whoops. * sigh. tests. remember the tests. * - removed Beta banner - removed Bold links in some pages - add Terms and Conditions in footers * - removed temporary Google Analytics - add Content Security Policy on header - moved some inline javascript call to a external file * forgot one inline onclick javascript * - implemented a whitelist for report names that can be call via the app URL. for now : only one report name is allowed : compliance * - forgot one file * build package for public app * fix syntax errors * fire new job names * added logic to only display the donut for Public users * forgot to remove bold for links for modal (How to read this table?) * removed some unwanted space * put back Beta Banner * Minor tweaks to config to enable usage of Azure Managed Service Identities in combination with Azure KeyVault. * this time with updated req's * local ci would be great when you're sleep deprived. * removed secret name out of code * Removed headers due to duplication.. The upstream servers are also placing these headers, so removing from here. * Security Update: pyyaml bump to pull in safe_load Fixes this yaml/pyyaml#74. Note we were already using safe_load. * Security Update: pyyaml version bump yaml/pyyaml#74 * Paginate scroll to top * add semi-colon * - Implementation of Google Tag Manager GTM ID is stored in Environment variable called GOOGLE_TAG_MANAGER * fix typo * fix data-domain, can't use comma to enclose value, break if value have comma in domain name * removed CSP policies from HTML header. CSP is now implemented on Nginx server. * - some cleanup before merge to Master branch * - to fix Alerts from LGTM * Compatibility with kubernetes (cds-snc#127) * Modification for deploying on k8s * Small fix on dockerfile * Added CI workflow file * Ignore pip pinning in CI * defer datatable render (cds-snc#129) * Changed worker type and worker amount (cds-snc#130) * Added PR review app configuration; * Actually hit the right container * Take 2 * Upgraded deps (cds-snc#132) Bump dependencies for pymongo and flask_pymongo. Fixes time based connection issues. * Task default organizations (cds-snc#136) * - set default view to Organizations instead of Domains - removed logic to public and internal view since now we will have same view for internal/public users * - fix some accessibilities issues * - put back role=row for TR. If not present, Mobile view doesnt display the green plus button in By Organizations page * - for Accessibility : implement "Skip to main content" link at top of pages ( visible when Tab into focus) * update content for the Guidance page (cds-snc#137)

https://bugs.gentoo.org/659348 It is reported that in PyYAML before 4.1, usage of yaml.load() function on untrusted input could lead to arbitrary code execution. It is therefore recommended to use yaml.safe_load() instead. With 4.1, yaml.load() has been changed to call safe_load(). * Report: http://seclists.org/oss-sec/2018/q2/240 * Upstream change: yaml/pyyaml#74 * CVE: pending -- Gentoo Security Scout Vladimir Krstulja

@asomov

Alex Gaynor (4): Make pyyaml safe by default. wtf, how did this typo happen Now, for py3k! Changes for 4.1 release Andrey Somov (1): Remove redundant code in Scanner.peek_token() Anthony Sottile (1): Install cython alongside tox Daniel Beer (1): Allow colon in a plain scalar in a flow context (#45) Donald Stufft (4): Add a tox.ini to run tests Ignore common build/runtime artifacts Add Travis Support Fallback to Pure Python if Compilation fails Florian Bruhin (1): Import Hashable from collections.abc Hugo (1): Test on Python 3.7-dev Ian Cordasco (1): Install tox in a virtualenv Ingy döt Net (6): Revert PR #150 per @asomov Changes for 4.01 release Reverting yaml/pyyaml#74 Deprecate/warn usage of yaml.load(input) Update .travis.yml to use libyaml 0.2.2 Updates for 5.1 release Jakub Wilk (1): Fix typos Jon Dufresne (5): Document and test Python 3.6 support Use Travis CI built in pip cache support Remove tox workaround for Travis CI Remove commented out Psyco code Include license file in the generated wheel package Kirill Simonov (1): Added tag 3.12 for changeset 823acfc7b4ff Matt Davis (4): Squash/merge pull request #105 from nnadeau/patch-1 Windows Appveyor build changes for 5.1.1 release changes for 5.1.2 release Peter Murphy (5): A change to a message First attack at pyyaml does not support literals in unicode over codepoint 0xffff #25 Added emoticon test data files (which will probably break testing) Suspicious 'expected an exception' messages trimmed Reverting README to old copy Timofei Bondarev (1): Improve RepresenterError creation Tina Müller (7): Support escaped slash in double quotes "\/" Force cython when building sdist Build libyaml on travis Apply FullLoader/UnsafeLoader changes to lib3 Allow to turn off sorting keys in Dumper Make default_flow_style=False Skip certain unicode tests when maxunicode not > 0xffff hsmtkk (1): add 3.12 changelog hugovk (1): Drop unsupported Python 3.3 psanchez (1): Resolves #57, update readme issues link scauligi (1): Fix for bug yaml/pyyaml#118

It is reported that in PyYAML before 4.1, usage of yaml.load() function on untrusted input could lead to arbitrary code execution. It is therefore recommended to use yaml.safe_load() instead. With 4.1, yaml.load() has been changed to call safe_load(). * Report: http://seclists.org/oss-sec/2018/q2/240 * Upstream change: yaml/pyyaml#74 * CVE: pending -- Gentoo Security Scout Vladimir Krstulja

alex added 2 commits August 26, 2017 09:26

Make pyyaml safe by default.

234261b

Change yaml.load/yaml.dump to be yaml.safe_load/yaml.safe_dump, introduced yaml.danger_dump/yaml.danger_load, and the same for various other classes. (python2 only at this moment) Refs yaml#5

wtf, how did this typo happen

24708ec

Now, for py3k!

97472b6

sigmavirus24 merged commit bbcf95f into yaml:master Aug 26, 2017

alex deleted the safe-load-best-load branch August 26, 2017 21:42

ypid mentioned this pull request Nov 21, 2017

Use yaml.safe_load instead of yaml.load to prevent avoid code execution elastic/curator#1105

Closed

alex mentioned this pull request Dec 10, 2017

Removed Python 2.6 & 3.3 #105

Merged

benkuhn mentioned this pull request Apr 10, 2018

Any plans to release a new version? #154

Closed

This comment has been minimized.

Sign in to view

jbagot mentioned this pull request Jun 27, 2018

Yaml serializer fails since pyyaml 4.1 kevin1024/vcrpy#366

Closed

altendky mentioned this pull request Jun 27, 2018

Build broken with new PyYaml==4.1 (or 4.1b1) ebroecker/canmatrix#161

Closed

ingydotnet mentioned this pull request Jun 29, 2018

Rework the safety related API code #189

Closed

ingydotnet added a commit that referenced this pull request Jun 29, 2018

Reverting #74

d85f7ed

Revert "Make pyyaml safe by default." This reverts commit bbcf95f. This reverts commit 7b68405. This reverts commit 517e83e.

ingydotnet added a commit that referenced this pull request Jun 29, 2018

Reverting #74

1d289e8

Revert "Make pyyaml safe by default." This reverts commit bbcf95f. This reverts commit 7b68405. This reverts commit 517e83e.

This was referenced Jun 29, 2018

PyYAML 4.2 Release Plan #193

Closed

Reverting https://github.com/yaml/pyyaml/pull/74 #194

Closed

ingydotnet added a commit that referenced this pull request Jun 30, 2018

Reverting #74

ccc40f3

Revert "Make pyyaml safe by default." This reverts commit bbcf95f. This reverts commit 7b68405. This reverts commit 517e83e.

Kobold mentioned this pull request Jul 18, 2018

CVE-2017-18342 status #207

Closed

ghost mentioned this pull request Sep 2, 2018

PyYAML, required by dparse, has vulnerability, so safety check always fails pyupio/safety#143

Closed

lafrech mentioned this pull request Sep 6, 2018

Use 'yaml.safe_load' in 'load_yaml_from_docstring' marshmallow-code/apispec#278

Closed

hugovk mentioned this pull request Oct 6, 2018

Dummy commit to requirements.txt to trigger snyk auth0/auth0-python#134

Closed

RealOrangeOne mentioned this pull request Jan 4, 2019

Security fixe reported by github #243

Closed

wolverineav added a commit to wolverineav/bosi that referenced this pull request Jan 4, 2019

update pyyaml version

4e0fde9

- known vulnerability in version <4.1 [1] [1] yaml/pyyaml#74

rcmcronny mentioned this pull request May 28, 2019

change "yaml.load" to better "yaml.safe_load" mischmeister/dmarchiver#4

Merged

vince-ice mentioned this pull request Jul 18, 2019

Insecure pyyaml call to load() qgis/QGIS#30779

Closed

cz-themax mentioned this pull request Oct 19, 2019

Update controller.py chestm007/amdgpu-fan#13

Merged

RhythmicGaming mentioned this pull request Jan 15, 2020

Bump pyyaml from 3.13 to 5.1 in /data_builders/edhrec UncannyBingo/magique#9

Closed

Ciemaar mentioned this pull request May 30, 2020

Bump pyyaml from 3.12 to 5.1 Ciemaar/flock#5

Merged

This was referenced Mar 17, 2021

Bump pyyaml from 3.10 to 5.1 in /devsecops/simplehttpserver Planet15/ncloud_infra_example#1

Merged

Bump pyyaml from 3.11 to 5.1 elrudrakssh/fuel#1

Closed

Bump pyyaml from 3.13 to 5.1 in /src/recommendationservice sjultra/mct-saved#6

Closed

damarisg mentioned this pull request Jul 19, 2022

Release 4.3.6 - Release Candidate 1 - E2E UX tests - Vulnerability Detector wazuh/wazuh-qa#3106

Closed

10 tasks

nona2512 mentioned this pull request Sep 4, 2022

[GHSA-rprw-h62v-c2w7] PyYAML insecurely deserializes YAML strings leading to arbitrary code execution github/advisory-database#638

Closed

gardera-security bot mentioned this pull request May 13, 2025

Update PyYAML to version >= 4.1 patriknordlen/gcp-audit#1

Closed

This was referenced Jun 24, 2025

Update PyYAML from version 3.12 to version >= 4.1 patriknordlen/gcp-audit#3

Closed

Update PyYAML from version 3.12 to version >= 4.1 patriknordlen/gcp-audit#5

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make pyyaml safe by default.#74

Make pyyaml safe by default.#74
sigmavirus24 merged 3 commits intoyaml:masterfrom
alex:safe-load-best-load

alex commented Aug 26, 2017 •

edited

Loading

Uh oh!

alex commented Aug 26, 2017

Uh oh!

sigmavirus24 commented Aug 26, 2017

Uh oh!

KevinHock commented Jun 26, 2018 •

edited

Loading

Uh oh!

hydrosquall commented Jun 27, 2018

Uh oh!

This comment has been minimized.

KevinHock commented Jun 27, 2018

Uh oh!

alex commented Jun 27, 2018

Uh oh!

jezdez commented Jun 28, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

alex commented Aug 26, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alex commented Aug 26, 2017

Uh oh!

sigmavirus24 commented Aug 26, 2017

Uh oh!

KevinHock commented Jun 26, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hydrosquall commented Jun 27, 2018

Uh oh!

This comment has been minimized.

KevinHock commented Jun 27, 2018

Uh oh!

alex commented Jun 27, 2018

Uh oh!

jezdez commented Jun 28, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

alex commented Aug 26, 2017 •

edited

Loading

KevinHock commented Jun 26, 2018 •

edited

Loading