CVE-2019-20477

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2019-20477

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20477.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-20477

Aliases

Related

Published

2020-02-19T04:15:10Z

Modified

2024-08-15T23:02:40Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

References

Affected packages

Debian:11 / pyyaml

Package

Name: pyyaml
Purl: pkg:deb/debian/pyyaml?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.2-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / pyyaml

Package

Name: pyyaml
Purl: pkg:deb/debian/pyyaml?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.2-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / pyyaml

Package

Name: pyyaml
Purl: pkg:deb/debian/pyyaml?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.2-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/yaml/pyyaml

Affected ranges

Type: GIT
Repo: https://github.com/yaml/pyyaml
Events: Introduced

e471e86bf6dabdad45a1438c20a4a5c033eb9034

Last affected

a9b98a3daa43d43afd8051b014d5b4154d141913