GitHub Advisoryadvisory · PyPI

GHSA-3pqx-4fqf-j49f Deserialization of Untrusted Data in PyYAML

CRITICAL Published 2021-04-20 Modified 2024-10-25 Official page ↗
Aliases
CVE-2019-20477
Ecosystem
PyPI
Packages
pyyaml
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-04-08

Affected packages

• PyPI pyyaml: >= 5.1, < 5.2 → fixed in 5.2

Description

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Related

Alias · CVE (1)

  • CVE-2019-20477 PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g.,… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References