Fedora has issued an advisory on March 27: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/ The issue is fixed upstream in 5.3.1. Mageia 7 is also affected.
Status comment: (none) => Fixed upstream in 5.3.1CC: (none) => bruno, jani.valimaa
Done for both Cauldron and mga7!
CC: (none) => geiger.david68210
Advisory: ======================== Updated python-yaml packages fix security vulnerability: A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor (CVE-2020-1747). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/ ======================== Updated packages in core/updates_testing: ======================== python2-yaml-5.3.1-1.mga7 python3-yaml-5.3.1-1.mga7 from python-yaml-5.3.1-1.mga7.src.rpm
Version: Cauldron => 7Assignee: python => qa-bugsStatus comment: Fixed upstream in 5.3.1 => (none)
mga7, x86_64 No PoC found for CVE-2020-1747 Went straight ahead and updated the packages. Used by ansible and rednotebook. Referring to earlier bug https://bugs.mageia.org/show_bug.cgi?id=23242 for tests based on the tutorial at https://pyyaml.org/wiki/PyYAMLDocumentation. The test scripts for python and python3 succeeded for the first seven tests then failed on test 8, just as before. Easier to test rednotebook than ansible. Installed rednotebook and updated the system menus. Found it under Office in Applications and launched it OK. Closed it and ran it from the command-line under strace. Made an entry for today and saved it then added a photo, viewed the text and picture in the preview and saved it again. Closed down. Checked ~/.rednotebook/diary to see that the new entry had been saved. It was there and python-yaml appeared in the trace. So that looks good.
CC: (none) => tarazed25Whiteboard: (none) => MGA7-64-OK
Validating. Advisory in Comment 2.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => advisoryCC: (none) => tmb
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0155.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED