Skip to content

Commit

Permalink
change "yaml.load" to better "yaml.safe_load"
Browse files Browse the repository at this point in the history
https://bugs.gentoo.org/659348

It is reported that in PyYAML before 4.1, usage of yaml.load() function on untrusted input could lead to arbitrary code execution. It is therefore recommended to use yaml.safe_load() instead. With 4.1, yaml.load() has been changed to call safe_load().

* Report:          http://seclists.org/oss-sec/2018/q2/240
* Upstream change: yaml/pyyaml#74
* CVE:             pending

--

Gentoo Security Scout
Vladimir Krstulja
  • Loading branch information
rcmcronny committed May 28, 2019
1 parent bb41a77 commit b6f0d51
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion dmarchiver.py
Expand Up @@ -34,7 +34,7 @@

try:
with open(config, 'r') as ymlfile:
cfg = yaml.load(ymlfile)
cfg = yaml.safe_load(ymlfile)

imap_host = cfg['imap']['imap_host']
imap_port = cfg['imap']['imap_port']
Expand Down

0 comments on commit b6f0d51

Please sign in to comment.