CVE-2019-20477
Published: 19 February 2020
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Notes
| Author | Note |
|---|---|
| mdeslaur | CVE-2017-18342 resulted in the load() function being deprecated in 5.1+ in eoan and later. It did not get fixed in previous release because of compatibility issues. This CVE therefore only really applies to eoan and later. |
Priority
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |