Vulnerability in dependency "pyyaml" found in setup/requirements_3.5.txt and setup/requirements_2.7.txt

IBMStreams / streamsx.nlp

Provide operations for text analysis, like lemmatization and text annotation with Uima Ruta scripts or existing project specific Uima pear files.

https://ibmstreams.github.io/streamsx.nlp/

Other

2 stars 7 forks source link

Closed schubon closed 5 years ago

schubon commented 5 years ago

Remediation Upgrade pyyaml to version 4.2b1 or later. For example:

pyyaml>=4.2b1

Vulnerable versions: < 4.2b1 Patched version: 4.2b1

In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.