CVE-2017-18342
CriticalAdvisory
Published 27 Jun 2018In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.057
- 93rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 78
- of 17,781 indexed, latest versions
- Container images
- 57
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
Carried by container images the latest versions of 78 of 17,781 indexed charts deploy, on 57 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pyyamlpypi | 3.10, 3.12, 3.13 | 5.1 | 57 |
| pyyamldeb | 3.10-4ubuntu0.1, 3.12-1build2 | no fix listed | 5 |
- OSV records
- GHSA-rprw-h62v-c2w7UBUNTU-CVE-2017-18342
- Also known as
- PYSEC-2018-49
Charts affected
78 by stars
Container images carrying it
57 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| oomk8s/ | 875814cc853d | pyyaml | 5.1 | 11 |
| osixia/ | 18742e9c449c | pyyaml | 5.1 | 7 |
| oomk8s/ | 7daa08b81954 | pyyaml | 5.1 | 6 |
| osixia/ | d112b82be133 | pyyaml | 5.1 | 5 |
| osixia/ | 1ab629698ae0 | pyyaml | 5.1 | 4 |
| omecproject/ | cfdb566dd949 | pyyaml | 5.1 | 2 |
| osixia/ | ccd95cc6e61e | pyyaml | 5.1 | 2 |
| osixia/ | d212a12aa728 | pyyaml | 5.1 | 2 |
| quay.io/ | f7f8228f17cc | pyyaml | 5.1 | 2 |
| amancevice/ | c8c04bfe3d66 | pyyaml | 5.1 | 1 |
| apachepulsar/ | 4db6ff0b4045 | pyyaml | 5.1 | 1 |
| buildkite/ | aec38cfaae0e | pyyaml | 5.1 | 1 |
| camptocamp/ | bff736b15623 | pyyaml | 5.1 | 1 |
| camptocamp/ | 2924b43dbf40 | pyyaml | 5.1 | 1 |
| ceph/ | 90f30824a96e | pyyaml | 5.1 | 1 |
| ceticasbl/ | 6c0aa7567145 | pyyaml | 5.1 | 1 |
| chetangautamm/ | b4b94155ff5a | pyyaml pyyaml | no fix listed 5.1 | 1 |
| codekoala/ | 4a999b2cfff2 | pyyaml | 5.1 | 1 |
| confluentinc/ | 1bbda887bc53 | pyyaml | 5.1 | 1 |
| confluentinc/ | c87b1c07fb53 | pyyaml | 5.1 | 1 |
| daskdev/ | 4ecd7bc35500 | pyyaml | 5.1 | 1 |
| daskdev/ | 052630f5ca04 | pyyaml | 5.1 | 1 |
| deconzcommunity/ | 6541bbb78952 | pyyaml | 5.1 | 1 |
| deepflowce/ | a1888d35e787 | pyyaml | 5.1 | 1 |
| elastichq/ | bb3bd22c2b87 | pyyaml | 5.1 | 1 |
| esailors/ | 5608ae045fa7 | pyyaml | 5.1 | 1 |
| fossology/ | 8bd1f22ba7bb | pyyaml | 5.1 | 1 |
| galaxy/ | 0267bad550e6 | pyyaml pyyaml | no fix listed 5.1 | 1 |
| galaxy/ | 8e577a626dfd | pyyaml pyyaml | no fix listed 5.1 | 1 |
| getsentry/ | 6ac37974fd2a | pyyaml | 5.1 | 1 |
| kennethreitz/ | 599fe5e50731 | pyyaml | 5.1 | 1 |
| kfserving/ | f322d6ffdfa3 | pyyaml | 5.1 | 1 |
| kiwigrid/ | 899ccd0b1f54 | pyyaml | 5.1 | 1 |
| kubeaws/ | c9cd2ba4373a | pyyaml | 5.1 | 1 |
| louislam/ | 0b55bcb83a1c | pyyaml | 5.1 | 1 |
| louislam/ | 3d632903e6af | pyyaml | 5.1 | 1 |
| louislam/ | 96510915e6be | pyyaml | 5.1 | 1 |
| louislam/ | a4eab252e5a2 | pyyaml | 5.1 | 1 |
| louislam/ | a84767d7934f | pyyaml | 5.1 | 1 |
| louislam/ | bc6f244ecf27 | pyyaml | 5.1 | 1 |
| ncsapolyglot/ | 438d82cdbdb5 | pyyaml | 5.1 | 1 |
| nlmacamp/ | 5dbb8589f824 | pyyaml | 5.1 | 1 |
| omecproject/ | d109a8e57e71 | pyyaml | 5.1 | 1 |
| opendatacube/ | 5d810e8504b8 | pyyaml | 5.1 | 1 |
| opendatacube/ | 91870111837c | pyyaml pyyaml | no fix listed 5.1 | 1 |
| opendatacube/ | 1b90cdf68831 | pyyaml pyyaml | no fix listed 5.1 | 1 |
| osixia/ | 58cce1b08592 | pyyaml | 5.1 | 1 |
| richardchesterwood/ | ed7d720878ac | pyyaml | 5.1 | 1 |
| roadiehq/ | ef355bf5b639 | pyyaml | 5.1 | 1 |
| voltha/ | c4e41e92f046 | pyyaml | 5.1 | 1 |