—

PYSEC-2021-429

Quick fix

PYSEC-2021-429 — slo-generator: upgrade to the fixed version with the command below.

pip install --upgrade 'slo-generator>=2.0.1'

Details

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/slo-generator

Introduced in: 0Fixed in: 2.0.1

Fixpip install --upgrade 'slo-generator>=2.0.1'

References

https://github.com/google/slo-generator/pull/173[WEB]
http://packetstormsecurity.com/files/164426/Google-SLO-Generator-2.0.0-Code-Execution.html[WEB]
https://github.com/advisories/GHSA-j28r-j54m-gpc4[ADVISORY]