GHSA-6757-jp84-gxfx
Improper Input Validation in PyYAML
At a glance
- Published
- Updated
- CVE
- CVE-2020-1747
- Aliases
- PYSEC-2020-96
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pyyaml | introduced 5.1b7, fixed 5.3.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-1747 ADVISORY
- https://github.com/github/advisory-database/pull/4942 WEB
- https://github.com/yaml/pyyaml/pull/386 WEB
- https://github.com/yaml/pyyaml/commit/0cedb2a0697b2bc49e4f3841b8d4590b6b15657e WEB
- https://github.com/yaml/pyyaml/commit/5080ba513377b6355a0502104846ee804656f1e0 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747 WEB
- https://github.com/advisories/GHSA-6757-jp84-gxfx ADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-96.yaml WEB
- https://github.com/yaml/pyyaml PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2 WEB
- https://www.oracle.com/security-alerts/cpujul2022.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |