Vulnerability · Published Mar 24, 2020 · Assigned by redhat

CVE-2020-1747

Critical 9.8

In plain English

A critical-severity improper input validation in PyYAML from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)5.4%top 7.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	python38-Cython	0.29.14-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-Cython	0.29.14-4.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-PyMySQL	0.10.1-1.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-asn1crypto	1.2.0-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-asn1crypto	1.2.0-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-atomicwrites	1.3.0-8.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-atomicwrites	1.3.0-8.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-attrs	19.3.0-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-attrs	19.3.0-3.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-cffi	1.13.2-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-cffi	1.13.2-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-chardet	3.0.4-19.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-chardet	3.0.4-19.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-cryptography	2.8-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-cryptography	2.8-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-idna	2.8-6.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-idna	2.8-6.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-markupsafe	1.1.1-6.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-markupsafe	1.1.1-6.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-mod_wsgi	4.6.8-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-mod_wsgi	4.6.8-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-more-itertools	7.2.0-5.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-more-itertools	7.2.0-5.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-packaging	19.2-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-packaging	19.2-3.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-pluggy	0.13.0-3.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-pluggy	0.13.0-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-ply	3.11-10.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-psycopg2	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-psycopg2	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2-doc	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2-doc	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-psycopg2-tests	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2-tests	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-py	1.8.0-8.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-py	1.8.0-8.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-pycparser	2.19-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-pycparser	2.19-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pyparsing	2.4.5-3.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-pyparsing	2.4.5-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-pysocks	1.7.1-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pysocks	1.7.1-4.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-pytest	4.6.6-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-pytest	4.6.6-3.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-pytz	2019.3-3.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-pytz	2019.3-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pyyaml	5.4.1-1.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-requests	2.22.0-9.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-requests	2.22.0-9.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-scipy	1.3.1-4.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-scipy	1.3.1-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-six	1.12.0-10.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
AlmaLinux:8	python38-wcwidth	0.1.7-16.module_el8.4.0+2510+cb4d423d	ALSA-2021:2583
AlmaLinux:8	python38-wcwidth	0.1.7-16.module_el8.6.0+2778+cd494b30	ALSA-2021:2583
Alpine:v3.20	py3-yaml	5.3.1-r0	ALPINE-CVE-2020-1747
Alpine:v3.21	py3-yaml	5.3.1-r0	ALPINE-CVE-2020-1747
Alpine:v3.22	py3-yaml	5.3.1-r0	ALPINE-CVE-2020-1747
Alpine:v3.23	py3-yaml	5.3.1-r0	ALPINE-CVE-2020-1747
Alpine:v3.24	py3-yaml	5.3.1-r0	ALPINE-CVE-2020-1747
Debian:12	pyyaml	5.3-2	DEBIAN-CVE-2020-1747
Debian:13	pyyaml	5.3-2	DEBIAN-CVE-2020-1747
Debian:14	pyyaml	5.3-2	DEBIAN-CVE-2020-1747
PyPI	pyyaml	5.3.1	GHSA-6757-jp84-gxfx
PyPI	pyyaml	5.3.1	PYSEC-2020-96
Rocky Linux:8	Cython	0:0.29.14-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	PyYAML	0:5.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	babel	0:2.7.0-10.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	mod_wsgi	0:4.6.8-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	numpy	0:1.17.3-5.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-asn1crypto	0:1.2.0-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-cffi	0:1.13.2-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-chardet	0:3.0.4-19.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.5.0+672+ab6eb015	RLSA-2020:4641
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-idna	0:2.8-6.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-jinja2	0:2.10.3-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-markupsafe	0:1.1.1-6.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psutil	0:5.6.4-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.6.0+794+eba84017	RLSA-2020:4641
Rocky Linux:8	python-pycparser	0:2.19-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-pysocks	0:1.7.1-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-requests	0:2.22.0-9.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-urllib3	0:1.25.7-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-wheel	0:0.33.6-5.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python3x-pip	0:19.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python3x-setuptools	0:41.6.0-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	pytz	0:2019.3-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.5.0+672+ab6eb015	RLSA-2020:4641

Affected products (as reported)

Vendor	Product	Versions
Red Hat	PyYAML	5.3.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

FEDORA-2020-40c35d7b37 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-bdb0bfa928 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-e9741a6a15 vendor-advisory, x_refsource_FEDORA
openSUSE-SU-2020:0507 vendor-advisory, x_refsource_SUSE
openSUSE-SU-2020:0630 vendor-advisory, x_refsource_SUSE
FEDORA-2021-3342569a0f vendor-advisory, x_refsource_FEDORA
FEDORA-2021-eed7193502 vendor-advisory, x_refsource_FEDORA
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747 x_refsource_CONFIRM
https://github.com/yaml/pyyaml/pull/386 x_refsource_MISC