{"action":"Upgrade pyyaml to 5.2 or later.","affected":[{"fixed":"5.2","introduced":"5.1"}],"component":"pyyaml","cve_ids":["CVE-2019-20477"],"ecosystem":"PyPI","epss":0.05114,"exploited":false,"fixed_versions":["5.2"],"ghsa_id":"GHSA-3pqx-4fqf-j49f","id":"tcs_01M5KEW7BRPJCFMBN9T30WWCJP","modified_at":"2024-10-25T21:23:11.506576Z","published_at":"2021-04-20T16:40:42Z","references":["https://osv.dev/vulnerability/GHSA-3pqx-4fqf-j49f","https://nvd.nist.gov/vuln/detail/CVE-2019-20477","https://github.com/advisories/GHSA-3pqx-4fqf-j49f","https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-176.yaml","https://github.com/yaml/pyyaml","https://github.com/yaml/pyyaml/blob/master/CHANGES","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H","https://www.exploit-db.com/download/47655"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-3pqx-4fqf-j49f","url":"https://osv.dev/vulnerability/GHSA-3pqx-4fqf-j49f"}],"summary":"Deserialization of Untrusted Data in PyYAML"}