[Snyk: High] arbitrary code execution (Due: 08/28/2020)

[jason-upchurch]

User story

as a user of openFEC, I want vulnerabilities to be patched.
https://app.snyk.io/vuln/SNYK-PYTHON-PYYAML-590151

Summary

A vulnerability is introduced through apispec@0.39.0:

in PyYAML@5.3.1
introduced by apispec@0.39.0 > PyYAML@5.3.1 and 2 other path(s)
  No upgrade or patch available

Completion criteria:

• Confirm this is a problem and if so, determine whether there is an upgrade and make that change
• If it's a confirmed vulnerability and if no remediation is available notify security

[lbeaufort]

Here's the PR I put in to apispec to use safe_load instead of load: marshmallow-code/apispec#281.

My assessment is that this isn't a vulnerability because:

• The apispec package doesn't use the vulnerable full_load or FullLoader
• We aren't executing untrusted YAML files

So, closing.