Genie has a vulnerable dependent library ruamel.yaml?

[Darven]

Hello,

It seems that one of the Genie dependent library, ruamel.yaml, has vulnerability issue.

Please refer to these links for more details.

https://nvd.nist.gov/vuln/detail/CVE-2019-20478#range-4480638

https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe%3A2.3%3Aa%3Aruamel.yaml_project%3Aruamel.yaml%3A0.1%3A*%3A*%3A*%3A*%3A*%3A*%3A*

I would like to know whether Genie library uses safe_load method for calling ruamel.yaml.

If no, is there a way to do so when I use pyATS?

[Alex Stevenson]

Hi @Darven,

That's a good question. I hope it uses the safe_load method and not the load method.

Here are a few places to find out!

• https://eurl.io/#r18UzrQVr - the pyATS team at Cisco DevNet manages Genie. Join the pyATS Community space on Cisco Webex
• pyats-support-ext@cisco.com - Try and email the pyATS team. This is their support email.
• https://developer.cisco.com/docs/genie-docs/ - Genie documentation
• CiscoTestAutomation/genielibs - This repo contains the Genie libs. Not sure if it's all-inclusive