Bug 544442 – <dev-python/pyyaml-3.12: assert failure when processing wrapped strings

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2015-03-25 10:21:47 UTC]

From ${URL} :

An assertion failure was found in the way the PyYAML library parsed wrapped strings. An attacker 
able to load specially crafted YAML input into an application using PyYAML could cause the 
application to crash.

This is the same flaw as CVE-2014-9130 but in the Python implementation of the YAML library. MITRE 
recommends it should be a separate issue:

http://seclists.org/oss-sec/2014/q4/854

Upstream patch:

https://bitbucket.org/xi/pyyaml/commits/ddf211a41bb231c365fece5599b7e484e6dc33fc


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Matthew Thode ( prometheanfire ) 2016-10-10 17:54:54 UTC]

3.12 has the fix, lets stablize that

Arches, please stabilize =dev-python/pyyaml-3.12 under the ALLARCHES policy.

[Comment 2 Agostino Sarubbo 2016-10-11 15:51:18 UTC]

amd64 stable

[Comment 3 Jeroen Roovers (RETIRED) 2016-10-11 18:12:37 UTC]

Stable for HPPA PPC64.

[Comment 4 Markus Meier 2016-10-18 19:44:46 UTC]

arm stable

[Comment 5 Agostino Sarubbo 2016-11-20 14:13:38 UTC]

Stable for arm64/ia64/m68k/ppc/s390/sh/sparc/x86 (ALLARCHES policy).

[Comment 6 Agostino Sarubbo 2016-11-20 16:16:32 UTC]

alpha stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 7 Dirkjan Ochtman (RETIRED) 2016-11-20 16:20:22 UTC]

Cleanup done.

[Comment 8 Aaron Bauman (RETIRED) 2016-11-20 22:16:52 UTC]

GLSA Vote: No