PyPI/pyyaml CVE-2020-14343: critical 9.8, EPSS 6.24%

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or

Action: Upgrade pyyaml to 5.4 or later.

pip install pyyaml==5.4

Affected

introduced	fixed	last affected
0	5.4	-

Fixed versions

5.4

Sources

osv: PYSEC-2021-142
nvd: CVE-2020-14343
https://bugzilla.redhat.com/show_bug.cgi?id=1860466
https://github.com/advisories/GHSA-8q59-q68h-6hv4

CVE-2020-14343 · published 2021-02-09T21:15:00Z · modified 2023-11-08T04:02:26.414885Z · JSON