CVE-2017-18342 @ Python-PyYAML-3.12

[pedrompflopes]

Vulnerable Package issue exists @ Python-PyYAML-3.12 in branch main

In PyYAML before 5.1b1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function was deprecated and the 'UnsafeLoader' was introduced for backward compatibility with the function.
NOTE: There was an initial fix which was later reverted. The actual fix occurred in the commit "857dff15".

Namespace: pedrompflopes
Repository: small-project
Repository Url: https://github.com/pedrompflopes/small-project
CxAST-Project: pedrompflopes/small-project
CxAST platform scan: c8ffe959-aafe-486d-a7e7-1ba92f6aee49
Branch: main
Application: small-project
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-20

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 5.4

---

References
Commit
Issue
Pull request
Advisory