Skip to content

Commit b6f0d51

Browse files
authored
change "yaml.load" to better "yaml.safe_load"
https://bugs.gentoo.org/659348 It is reported that in PyYAML before 4.1, usage of yaml.load() function on untrusted input could lead to arbitrary code execution. It is therefore recommended to use yaml.safe_load() instead. With 4.1, yaml.load() has been changed to call safe_load(). * Report: http://seclists.org/oss-sec/2018/q2/240 * Upstream change: yaml/pyyaml#74 * CVE: pending -- Gentoo Security Scout Vladimir Krstulja
1 parent bb41a77 commit b6f0d51

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

dmarchiver.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434

3535
try:
3636
with open(config, 'r') as ymlfile:
37-
cfg = yaml.load(ymlfile)
37+
cfg = yaml.safe_load(ymlfile)
3838

3939
imap_host = cfg['imap']['imap_host']
4040
imap_port = cfg['imap']['imap_port']

0 commit comments

Comments
 (0)