PyPI/pyyaml CVE-2020-1747: unknown, EPSS 5.44%
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method o
Action: Upgrade pyyaml to 5.3.1 or later.
pip install pyyaml==5.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.1 | 5.3.1 | - |
Fixed versions
| 5.3.1 |
Sources
- osv: PYSEC-2020-96
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747
- https://github.com/yaml/pyyaml/pull/386
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY/
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX/
- https://github.com/advisories/GHSA-6757-jp84-gxfx
CVE-2020-1747 · published · modified · JSON