Upgrading PyYAML 3 to 5
Breaking3.13 → 5.4.1Security5Platform1Deprecated1New3Changed5Fixed6Other18
SecurityA vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.GHSA-8q59-q68h-6hv4 · CVE-2020-14343 ↗
BreakingUpgrade verdict
A platform requirement change and 5 security fixes.
In plain terms
- PyYAML no longer runs on Python 2.6 or Python 3.3.
- A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
- A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
- FullLoader no longer constructs python/object/apply tags by default, reducing the risk of unsafe object construction.
Must act Top 5 of 7 that need code or config changes
Requires Python >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.* from 5.4b1 (none stated before).
What you must change
Security5
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Makes FullLoader safer by removing python/object/apply from the default FullLoader.
FullLoaderUnsafeConstructorpython/object/applyPyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
Platform1
Removes Python 2.6 and 3.3 support.
Deprecations to plan for
Deprecated1
Deprecates yaml.load and adds FullLoader and UnsafeLoader classes.
yaml.loadFullLoaderUnsafeLoaderAPI changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- changed:
function dump_all(documents, stream=…, Dumper=…, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…) → function dump_all(documents, stream=…, Dumper=…, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…, sort_keys=…) - added:
class YAMLLoadWarning(RuntimeWarning) - added:
function full_load(stream) - added:
function full_load_all(stream) - added:
function load_warning(method) - added:
function unsafe_load(stream) - added:
function unsafe_load_all(stream) - added:
function warnings(settings=…)
- changed:
constructor CBaseDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…) → constructor CBaseDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…, sort_keys=…) - changed:
constructor CDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…) → constructor CDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…, sort_keys=…) - changed:
constructor CSafeDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…) → constructor CSafeDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…, sort_keys=…) - added:
class CFullLoader(CParser, FullConstructor, Resolver) - added:
class CUnsafeLoader(CParser, UnsafeConstructor, Resolver) - added:
constructor CFullLoader(stream) - added:
constructor CUnsafeLoader(stream)
- changed:
constructor BaseDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…) → constructor BaseDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…, sort_keys=…) - changed:
constructor Dumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…) → constructor Dumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…, sort_keys=…) - changed:
constructor SafeDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…) → constructor SafeDumper(stream, default_style=…, default_flow_style=…, canonical=…, indent=…, width=…, allow_unicode=…, line_break=…, encoding=…, explicit_start=…, explicit_end=…, version=…, tags=…, sort_keys=…)
- added:
class FullLoader(Reader, Scanner, Parser, Composer, FullConstructor, Resolver) - added:
class UnsafeLoader(Reader, Scanner, Parser, Composer, Constructor, Resolver) - added:
constructor FullLoader(stream) - added:
constructor UnsafeLoader(stream)
- changed:
constructor BaseRepresenter(default_style=…, default_flow_style=…) → constructor BaseRepresenter(default_style=…, default_flow_style=…, sort_keys=…)