CVE-2020-14343

A vulnerability was discovered in the PyYAML library in versions before
5.4, where it is susceptible to arbitrary code execution when it processes
untrusted YAML files through the full_load method or with the FullLoader
loader. Applications that use the library to process untrusted input may be
vulnerable to this flaw. This flaw allows an attacker to execute arbitrary
code on the system by abusing the python/object/new constructor. This flaw
is due to an incomplete fix for CVE-2020-1747.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966233&gt;
• <https://github.com/yaml/pyyaml/issues/420&gt;

Notes