CVE-2020-14343

high-risk
Published 2021-02-09

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Do I need to act?

!
13.7% chance of exploitation in next 30 days
EPSS score — higher than 86% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (3)

Pyyaml

Affected Vendors

Oracle Pyyaml

References (10)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1860466
https://github.com/SeldonIO/seldon-core/issues/2252
https://github.com/yaml/pyyaml/issues/420
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1860466
https://github.com/SeldonIO/seldon-core/issues/2252
https://github.com/yaml/pyyaml/issues/420
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
53
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 12/34 · Low
Exposure 9/34 · Low