qlib Deserialization of Untrusted Data vulnerability
Date: 2022-05
Affected: pip/pyqlib
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2021-23338
CWE: CWE-502
CWE-94
CVSS: 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.


Mitigations:

Architectural layers (MAESTRO):