Lucene search

RedhatCVE-2020-1747

HistoryMar 24, 2020 - 3:15 p.m.

CVE-2020-1747

2020-03-2415:15:12

CWE-20

redhat

web.nvd.nist.gov

286

pyyaml

vulnerability

arbitrary code execution

untrusted input

nvd

cve-2020-1747

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

77.9%

JSON

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Affected configurations

Nvd

Vulners

Node

pyyamlpyyamlRange5.1–5.3.1

Node

fedoraprojectfedoraMatch30

fedoraprojectfedoraMatch31

fedoraprojectfedoraMatch32

fedoraprojectfedoraMatch33

Node

opensuseleapMatch15.1

Node

oraclecommunications_cloud_native_core_network_function_cloud_native_environmentMatch22.1.0

VendorProductVersionCPE
redhatredhat_package_manager*cpe:2.3:a:redhat:redhat_package_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	redhat_package_manager	*	cpe:2.3:a:redhat:redhat_package_manager::::::::

CNA Affected

[
  {
    "product": "PyYAML",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "5.3.1"
      }
    ]
  }
]