CVE-2017-2809 (Python, published 2017-09-14T19:29Z)
Description: value: An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/tomoh1r/ansible-vault
Files changed:
.travis.yml
CHANGES.txt
README.rst
README_test.rst
ansible_vault/api.py
ansible_vault/test/file/pwned.txt
ansible_vault/test/test_api.py
setup.cfg
setup.py
Commit message: Fix security issue refs #4

* Update version to 1.0.5
* Update to use yaml.safe_load()
* Update to tomoh1r


Vulnerable code:
- 2.7
env:
  matrix:
    - TOXENV=py27
    - TOXENV=py27-ansible2
  - pip install tox
script: tox
.. image:: https://travis-ci.org/jptomo/ansible-vault.svg?branch=master
   :target: https://travis-ci.org/jptomo/ansible-vault
        return yaml.load(self.vault.decrypt(stream))
from testfixtures import ShouldRaise

    version='1.0.4',
    url='https://github.com/jptomo/ansible-vault',
    tests_require=['pytest', 'testfixtures'],
[tox]
envlist = py27, py27-ansible2
setupdir = .

[testenv]
basepython = python2.7

[testenv:py27]
commands = python2.7 setup.py test

[testenv:py27-ansible2]
commands =
    pip install -U git+https://github.com/ansible/ansible.git@stable-2.0#egg=ansible
    python2.7 setup.py test

Fixed code:
cache:
  directories:
    - $HOME/.cache/pip
  - "2.7"
  - "3.3"
  - "3.4"
  - "3.5"
  - "3.6"
  - python -m pip install -U setuptools pip
  - python setup.py setup_test
script:
  - python -m pytest
  - if [ "$TRAVIS_PYTHON_VERSION" == '2.7' ] ; then python -m pip install -U 'ansible<2.0.0' && python -m pytest ; fi
1.0.5 (2017/09/13)

* Update to use yaml.safe_load()$
* Update to tomoh1r$

1.0.4 (2015/11/29)

* Apply to Ansible 2
* Add unit tests

.. image:: https://travis-ci.org/tomoh1r/ansible-vault.svg?branch=master
   :target: https://travis-ci.org/tomoh1r/ansible-vault
      $ ./venvtest/bin/python setup.py setup_test
        return yaml.safe_load(self.vault.decrypt(stream))
$ANSIBLE_VAULT;1.1;AES256
31616433623434626463363932323936663066353063393731346536636437633463633137643032
3663656431663830396662646132343735623538346330640a363532326262353732636161633431
61353936346235396464333333653831356638393264343662363362653433353762396663653465
6439366430336336660a363931663030323665633136363362353162333864653933653763656462
31656431653333343834623731393263393865353831333963616165613237376630646665306363
6238373037663462343565643737303136333032386136356438
from testfixtures import ShouldRaise
from yaml.constructor import ConstructorError
    def test_not_pwned(self):
        fpath = os.path.join(here, 'file', 'pwned.txt')
        vault = self._makeOne('password')
        with ShouldRaise(ConstructorError):
            vault.load(open(fpath).read())


[aliases]
setup_test = develop easy_install ansible-vault[test]
release = register clean --all sdist

[tools:pytest]
norecursedirs = venv
testpaths = ansible_vault/test
    version='1.0.5',
    url='https://github.com/tomoh1r/ansible-vault',
    extras_require = {
        'test': ['pytest', 'testfixtures'],
    }