CVE-2020-14343

State: Published
Severity: Not scored
Published: Feb 9, 2021
Updated: Aug 4, 2024
Reserved: Jun 17, 2020

Description

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Scores

The record has no CVSS score.

Weaknesses

CWE-20

Affected Products

Product	Versions
PyYAMLn/a	PyYAML 5.4Affected

References

https://github.com/yaml/pyyaml/issues/420
https://bugzilla.redhat.com/show_bug.cgi?id=1860466
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://github.com/SeldonIO/seldon-core/issues/2252

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.