On Fri, 2019-05-03 at 11:03 +0100, Daniel P. Berrangé wrote:
The yaml.load() method is historically unsafe as it allowed for
arbitrary code execution:
./lcitool:323: YAMLLoadWarning: calling yaml.load() without
Loader=... is deprecated, as the default Loader is unsafe.
Please read
https://msg.pyyaml.org/load for full details.
The PyYAML >= 5.1 is now safe by default, but has none the less
deprecated the plain load() method to avoid risk for people
running their app on older versions. For our needs safe_load()
suffices and is compatible with RHEL-7
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
guests/lcitool | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
Reviewed-by: Andrea Bolognani <abologna(a)redhat.com>
--
Andrea Bolognani / Red Hat / Virtualization