// For flags

CVE-2020-14343

PyYAML: incomplete fix for CVE-2020-1747

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Se detectó una vulnerabilidad en la biblioteca PyYAML en versiones anteriores a 5.4, donde es susceptible una ejecución de código arbitrario cuando se procesan archivos YAML no confiables por medio del método full_load o con el cargador FullLoader. Unas aplicaciones que usan la biblioteca para procesar entradas que no son confiables pueden ser vulnerables a este fallo. Este fallo le permite a un atacante ejecutar código arbitrario en el sistema abusando del constructor python/object/new. Este fallo se debe a una corrección incompleta para CVE-2020-1747

A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-06-17 CVE Reserved
  • 2021-02-09 CVE Published
  • 2022-04-19 First Exploit
  • 2023-10-26 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pyyaml
Search vendor "Pyyaml"
 Pyyaml
Search vendor "Pyyaml" for product "Pyyaml"
 >= 5.1 < 5.4
Search vendor "Pyyaml" for product "Pyyaml" and version " >= 5.1 < 5.4"
-
Affected
Oracle
Search vendor "Oracle"
 Communications Cloud Native Core Network Function Cloud Native Environment
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment"
 1.10.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" and version "1.10.0"
-
Affected
Oracle
Search vendor "Oracle"
 Communications Cloud Native Core Network Function Cloud Native Environment
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment"
 22.1.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" and version "22.1.0"
-
Affected