YaqlYamlLoader inherits from YamlLoader
Bug #1586078 reported by
Kirill Zaitsev
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
python-muranoclient |
Fix Released
|
Critical
|
Kirill Zaitsev | ||
Kilo |
Won't Fix
|
Undecided
|
Unassigned | ||
Liberty |
Fix Committed
|
Critical
|
Kirill Zaitsev | ||
Mitaka |
Fix Committed
|
Critical
|
Kirill Zaitsev | ||
Newton |
Fix Released
|
Critical
|
Kirill Zaitsev |
Bug Description
YaqlYamlLoader inherits from YamlLoader, meaning that it is possible to use extended unsafe tags in yaml files http://
CVE References
Changed in python-muranoclient: | |
assignee: | nobody → Kirill Zaitsev (kzaitsev) |
no longer affects: | python-muranoclient/0.5.x |
description: | updated |
tags: | added: security |
information type: | Private Security → Public Security |
description: | updated |
To post a comment you must log in.
looks good to be. Tried to test if it can cause old bugs to return again and seems that everything is okay now. However the patch for the engine is missing. And when changing YaqlYamlLoader there remember to change Constructor to SafeConstructor as well