Mageia alert MGASA-2020-0155 (python-yaml)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0155: Updated python-yaml packages fix security vulnerability 
Date:
             
 
Fri, 3 Apr 2020 00:49:48 +0200
Message-ID:
             
 
<20200402224948.6208D9F63F@duvel.mageia.org>
MGASA-2020-0155 - Updated python-yaml packages fix security vulnerability

Publication date: 02 Apr 2020
URL: https://advisories.mageia.org/MGASA-2020-0155.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-1747

Description:
Updated python-yaml packages fix security vulnerability:

A vulnerability was discovered in the PyYAML library, where it is
susceptible to arbitrary code execution when it processes untrusted
YAML files through the full_load method or with the FullLoader loader.
Applications that use the library to process untrusted input may be
vulnerable to this flaw. An attacker could use this flaw to execute
arbitrary code on the system by abusing the python/object/new
constructor (CVE-2020-1747).

References:
- https://bugs.mageia.org/show_bug.cgi?id=26405
-
https://lists.fedoraproject.org/archives/list/package-ann...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747

SRPMS:
- 7/core/python-yaml-5.3.1-1.mga7