CVE-2021-4118: Deserialization of Untrusted Data (CWE-502)
value: pytorch-lightning is vulnerable to Deserialization of Untrusted Data
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.8
Published: 2021-12-23T18:15Z
Repository: https://github.com/pytorchlightning/pytorch-lightning
Language: Python
Files changed: CHANGELOG.md, pytorch_lightning/core/saving.py, requirements.txt, tests/loggers/test_csv.py
Commit date: 2021-12-17 20:27:15 +0000
Commit message: Fix CVE-2020-1747 and CVE-2020-14343 (#11099)


Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9990bff5..5dec23f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -291,14 +291,14 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 - Removed `Accelerator.on_train_start` ([#10999](https://github.com/PyTorchLightning/pytorch-lightning/pull/10999))
 
 ### Fixed
 
-- Fixed a bug to disable logging hyperparameters in logger if there are no hparams ([#11105](https://github.com/PyTorchLightning/pytorch-lightning/issues/11105))
+- Fixed security vulnerabilities CVE-2020-1747 and CVE-2020-14343 caused by the `PyYAML` dependency ([#11099](https://github.com/PyTorchLightning/pytorch-lightning/pull/11099))
 
 
--
+- Fixed a bug to disable logging hyperparameters in logger if there are no hparams ([#11105](https://github.com/PyTorchLightning/pytorch-lightning/issues/11105))
 
 
 - Avoid the deprecated `onnx.export(example_outputs=...)` in torch 1.10 ([#11116](https://github.com/PyTorchLightning/pytorch-lightning/pull/11116))
 
 
diff --git a/pytorch_lightning/core/saving.py b/pytorch_lightning/core/saving.py
index 4d9c820d..8bc751fe 100644
--- a/pytorch_lightning/core/saving.py
+++ b/pytorch_lightning/core/saving.py
@@ -342,11 +342,11 @@ def load_hparams_from_yaml(config_yaml: str, use_omegaconf: bool = True) -> Dict
     if not fs.exists(config_yaml):
         rank_zero_warn(f"Missing Tags: {config_yaml}.", category=RuntimeWarning)
         return {}
 
     with fs.open(config_yaml, "r") as fp:
-        hparams = yaml.load(fp, Loader=yaml.UnsafeLoader)
+        hparams = yaml.full_load(fp)
 
     if _OMEGACONF_AVAILABLE:
         if use_omegaconf:
             try:
                 return OmegaConf.create(hparams)
diff --git a/requirements.txt b/requirements.txt
index 94b7151d..c708817b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,11 +2,11 @@
 
 numpy>=1.17.2
 torch>=1.7.*
 future>=0.17.1  # required for builtins in setup.py
 tqdm>=4.41.0
-PyYAML>=5.1
+PyYAML>=5.4
 fsspec[http]>=2021.05.0, !=2021.06.0
 tensorboard>=2.2.0
 torchmetrics>=0.4.1
 pyDeprecate==0.3.1
 packaging>=17.0
diff --git a/tests/loggers/test_csv.py b/tests/loggers/test_csv.py
index 1985bbe7..b5aae1db 100644
--- a/tests/loggers/test_csv.py
+++ b/tests/loggers/test_csv.py
@@ -10,11 +10,10 @@
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
 import os
-from argparse import Namespace
 from unittest.mock import MagicMock
 
 import pytest
 import torch
 
@@ -93,11 +92,10 @@ def test_file_logger_log_hyperparams(tmpdir):
         "int": 1,
         "string": "abc",
         "bool": True,
         "dict": {"a": {"b": "c"}},
         "list": [1, 2, 3],
-        "namespace": Namespace(foo=Namespace(bar="buzz")),
         "layer": torch.nn.BatchNorm1d,
     }
     logger.log_hyperparams(hparams)
     logger.save()
 

Vulnerable code: - Fixed a bug to disable logging hyperparameters in logger if there are no hparams ([#11105](https://github.com/PyTorchLightning/pytorch-lightning/issues/11105))
-
        hparams = yaml.load(fp, Loader=yaml.UnsafeLoader)
PyYAML>=5.1
from argparse import Namespace
        "namespace": Namespace(foo=Namespace(bar="buzz")),
Fixed code: - Fixed security vulnerabilities CVE-2020-1747 and CVE-2020-14343 caused by the `PyYAML` dependency ([#11099](https://github.com/PyTorchLightning/pytorch-lightning/pull/11099))
- Fixed a bug to disable logging hyperparameters in logger if there are no hparams ([#11105](https://github.com/PyTorchLightning/pytorch-lightning/issues/11105))
        hparams = yaml.full_load(fp)
PyYAML>=5.4