YaqlYamlLoader inherits from YamlLoader

Bug #1586078 reported by Kirill Zaitsev
270
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-muranoclient
Fix Released
Critical
Kirill Zaitsev
Kilo
Won't Fix
Undecided
Unassigned
Liberty
Fix Committed
Critical
Kirill Zaitsev
Mitaka
Fix Committed
Critical
Kirill Zaitsev
Newton
Fix Released
Critical
Kirill Zaitsev

Bug Description

YaqlYamlLoader inherits from YamlLoader, meaning that it is possible to use extended unsafe tags in yaml files http://pyyaml.org/wiki/PyYAMLDocumentation#YAMLtagsandPythontypes

Tags: security

CVE References

Changed in python-muranoclient:
assignee: nobody → Kirill Zaitsev (kzaitsev)
no longer affects: python-muranoclient/0.5.x
description: updated
tags: added: security
Revision history for this message
Kirill Zaitsev (kzaitsev) wrote :
Revision history for this message
Kirill Zaitsev (kzaitsev) wrote :
Revision history for this message
Kirill Zaitsev (kzaitsev) wrote :
Revision history for this message
Kirill Zaitsev (kzaitsev) wrote :
Revision history for this message
Stan Lagun (slagun) wrote :

looks good to be. Tried to test if it can cause old bugs to return again and seems that everything is okay now. However the patch for the engine is missing. And when changing YaqlYamlLoader there remember to change Constructor to SafeConstructor as well

information type: Private Security → Public Security
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-muranoclient (master)

Reviewed: https://review.openstack.org/333440
Committed: https://git.openstack.org/cgit/openstack/python-muranoclient/commit/?id=cd182ba363a11078ae7a0595f54751c1ebddd2e0
Submitter: Jenkins
Branch: master

commit cd182ba363a11078ae7a0595f54751c1ebddd2e0
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 01:04:31 2016 +0300

    Use yaml.SafeLoader instead of yaml.Loader

    Before this patch yaml.Loader was used by the client to create custom
    yaql-enabled yaml loader. It is unsfae do to so, because yaml.Loader is
    capable of creating custom python objects from specifically constructed
    yaml files.
    UI parsing functions also fell back to yaml.Loader if
    the custom loader was not supplied.
    After this patch all yaml load operations are performed with safe
    loaders instead.

    Change-Id: Id9bb6eabda35522271ec394f8758a974878cbb4b
    Closes-Bug: #1586078

Changed in python-muranoclient:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-muranoclient (stable/mitaka)

Reviewed: https://review.openstack.org/333443
Committed: https://git.openstack.org/cgit/openstack/python-muranoclient/commit/?id=e470430814ceddadea66d2e4bb3a9b10b55869e6
Submitter: Jenkins
Branch: stable/mitaka

commit e470430814ceddadea66d2e4bb3a9b10b55869e6
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 01:04:31 2016 +0300

    Use yaml.SafeLoader instead of yaml.Loader

    Before this patch yaml.Loader was used by the client to create custom
    yaql-enabled yaml loader. It is unsfae do to so, because yaml.Loader is
    capable of creating custom python objects from specifically constructed
    yaml files.
    UI parsing functions also fell back to yaml.Loader if
    the custom loader was not supplied.
    After this patch all yaml load operations are performed with safe
    loaders instead.

    Change-Id: Id9bb6eabda35522271ec394f8758a974878cbb4b
    Closes-Bug: #1586078

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-muranoclient (stable/liberty)

Reviewed: https://review.openstack.org/333444
Committed: https://git.openstack.org/cgit/openstack/python-muranoclient/commit/?id=b1e8a1753ccc3faf06840f675403645311ac9d79
Submitter: Jenkins
Branch: stable/liberty

commit b1e8a1753ccc3faf06840f675403645311ac9d79
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 01:04:31 2016 +0300

    Use yaml.SafeLoader instead of yaml.Loader

    Before this patch yaml.Loader was used by the client to create custom
    yaql-enabled yaml loader. It is unsfae do to so, because yaml.Loader is
    capable of creating custom python objects from specifically constructed
    yaml files.
    UI parsing functions also fell back to yaml.Loader if
    the custom loader was not supplied.
    After this patch all yaml load operations are performed with safe
    loaders instead.

    Change-Id: Id9bb6eabda35522271ec394f8758a974878cbb4b
    Closes-Bug: #1586078

description: updated
Revision history for this message
Doug Hellmann (doug-hellmann) wrote : Fix included in openstack/python-muranoclient 0.9.0

This issue was fixed in the openstack/python-muranoclient 0.9.0 release.

Revision history for this message
Doug Hellmann (doug-hellmann) wrote : Fix included in openstack/python-muranoclient 0.8.5

This issue was fixed in the openstack/python-muranoclient 0.8.5 release.

Revision history for this message
Doug Hellmann (doug-hellmann) wrote : Fix included in openstack/python-muranoclient 0.7.3

This issue was fixed in the openstack/python-muranoclient 0.7.3 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

This issue was fixed in the openstack/python-muranoclient 0.7.3 release.

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.