{"action":"Upgrade pyyaml to 5.2b1 or later.","affected":[{"fixed":"5.2b1","introduced":"5.1"}],"component":"pyyaml","cve_ids":["CVE-2019-20477"],"ecosystem":"PyPI","epss":0.05114,"exploited":false,"fixed_versions":["5.2b1"],"ghsa_id":"GHSA-3pqx-4fqf-j49f","id":"tcs_01M5KG9PKZWRYY5QHAPSN2FPBY","modified_at":"2023-11-08T04:01:30.627114Z","published_at":"2020-02-19T04:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-176","https://www.exploit-db.com/download/47655","https://github.com/yaml/pyyaml/blob/master/CHANGES","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN/","https://github.com/advisories/GHSA-3pqx-4fqf-j49f"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-176","url":"https://osv.dev/vulnerability/PYSEC-2020-176"}],"summary":"PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue ex"}