<?xml version="1.0" encoding="utf-8"?>
  <?xml-stylesheet type="text/xsl" href="sa-render.xsl"?>
  <update from="huaweicloud.com" type="security" status="stable" version="1">
    <id>HCE1-SA-2022-0033</id>
    <title>An update for PyYAML is now available for HCE 1.1</title>
    <severity>Critical</severity>
    <release>HCE 1.1</release>
    <issued date="2022-10-18 09:08:08"/>
    <updated date="2022-10-18 09:08:08"/>
    <references>
      <reference href="https://nvd.nist.gov/vuln/detail/CVE-2017-18342" id="CVE-2017-18342" title="CVE-2017-18342 Base Score: 9.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" type="cve"/>
    </references>
    <description>Security Fix(es):

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function. (CVE-2017-18342)
</description>
    <pkglist>
      <collection short="HCE 1.1" package="PyYAML">
        <name>HCE 1.1</name>
        <package arch="x86_64" name="PyYAML" version="3.10" release="12.hce1c">
          <filename>PyYAML-3.10-12.hce1c.x86_64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
