—

PYSEC-2020-341

Quick fix

PYSEC-2020-341 — jw-util: upgrade to the fixed version with the command below.

pip install --upgrade 'jw-util>=2.3'

Details

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/jw-util

Introduced in: 0Fixed in: 2.3

Fixpip install --upgrade 'jw-util>=2.3'

References

https://joel-malwarebenchmark.github.io[WEB]
https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/[ARTICLE]
https://security.netapp.com/advisory/ntap-20200528-0002/[ADVISORY]
https://github.com/advisories/GHSA-h72c-w3q3-55qq[ADVISORY]