Skip to content

Deserialization of Untrusted Data in PyYAML

High severity GitHub Reviewed Published Apr 20, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

pip pyyaml (pip)

Affected versions

>= 5.1, < 5.2

Patched versions

5.2

Description

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

References

Published by the National Vulnerability Database Feb 19, 2020
Reviewed Apr 8, 2021
Published to the GitHub Advisory Database Apr 20, 2021
Last updated Feb 1, 2023

Severity

High

Weaknesses

CVE ID

CVE-2019-20477

GHSA ID

GHSA-3pqx-4fqf-j49f

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.