CVE-2019-20477: Critical severity pyyaml vulnerability
A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/apply constructor.
Other sources
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20477?
CVE-2019-20477 is a vulnerability in the PyYAML library that allows arbitrary code execution when processing untrusted YAML files.
What software versions are affected by CVE-2019-20477?
PyYAML versions 5.1 through 5.1.2 are affected by CVE-2019-20477.
How severe is CVE-2019-20477?
CVE-2019-20477 has a severity rating of 9.8 (Critical).
How can I fix CVE-2019-20477?
To fix CVE-2019-20477, upgrade to PyYAML version 5.2.
Where can I find more information about CVE-2019-20477?
You can find more information about CVE-2019-20477 at the following references: [Link 1](https://access.redhat.com/security/cve/CVE-2017-18342), [Link 2](https://github.com/yaml/pyyaml/blob/master/CHANGES), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1806010).