A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-python38-asn1cryptoalma-upgrade-python38-atomicwritesalma-upgrade-python38-attrsalma-upgrade-python38-cffialma-upgrade-python38-chardetalma-upgrade-python38-cryptographyalma-upgrade-python38-cythonalma-upgrade-python38-idnaalma-upgrade-python38-markupsafealma-upgrade-python38-mod_wsgialma-upgrade-python38-more-itertoolsalma-upgrade-python38-packagingalma-upgrade-python38-pluggyalma-upgrade-python38-plyalma-upgrade-python38-psycopg2alma-upgrade-python38-psycopg2-docalma-upgrade-python38-psycopg2-testsalma-upgrade-python38-pyalma-upgrade-python38-pycparseralma-upgrade-python38-pymysqlalma-upgrade-python38-pyparsingalma-upgrade-python38-pysocksalma-upgrade-python38-pytestalma-upgrade-python38-pytzalma-upgrade-python38-pyyamlalma-upgrade-python38-requestsalma-upgrade-python38-scipyalma-upgrade-python38-sixalma-upgrade-python38-wcwidth | May 4, 2022 | Feb 9, 2021 | |
| Alpine Linux | alpine-linux-upgrade-py3-yaml | Mar 26, 2024 | Feb 9, 2021 | |
| Centos_linux | — | centos-upgrade-cython-debugsourcecentos-upgrade-numpy-debugsourcecentos-upgrade-python-cffi-debugsourcecentos-upgrade-python-cryptography-debugsourcecentos-upgrade-python-lxml-debugsourcecentos-upgrade-python-markupsafe-debugsourcecentos-upgrade-python-psutil-debugsourcecentos-upgrade-python-psycopg2-debugsourcecentos-upgrade-python38centos-upgrade-python38-asn1cryptocentos-upgrade-python38-babelcentos-upgrade-python38-cfficentos-upgrade-python38-cffi-debuginfocentos-upgrade-python38-chardetcentos-upgrade-python38-cryptographycentos-upgrade-python38-cryptography-debuginfocentos-upgrade-python38-cythoncentos-upgrade-python38-cython-debuginfocentos-upgrade-python38-debugcentos-upgrade-python38-debuginfocentos-upgrade-python38-debugsourcecentos-upgrade-python38-develcentos-upgrade-python38-idlecentos-upgrade-python38-idnacentos-upgrade-python38-jinja2centos-upgrade-python38-libscentos-upgrade-python38-lxmlcentos-upgrade-python38-lxml-debuginfocentos-upgrade-python38-markupsafecentos-upgrade-python38-markupsafe-debuginfocentos-upgrade-python38-mod_wsgicentos-upgrade-python38-numpycentos-upgrade-python38-numpy-debuginfocentos-upgrade-python38-numpy-doccentos-upgrade-python38-numpy-f2pycentos-upgrade-python38-pipcentos-upgrade-python38-pip-wheelcentos-upgrade-python38-plycentos-upgrade-python38-psutilcentos-upgrade-python38-psutil-debuginfocentos-upgrade-python38-psycopg2centos-upgrade-python38-psycopg2-debuginfocentos-upgrade-python38-psycopg2-doccentos-upgrade-python38-psycopg2-testscentos-upgrade-python38-pycparsercentos-upgrade-python38-pymysqlcentos-upgrade-python38-pysockscentos-upgrade-python38-pytzcentos-upgrade-python38-pyyamlcentos-upgrade-python38-pyyaml-debuginfocentos-upgrade-python38-requestscentos-upgrade-python38-rpm-macroscentos-upgrade-python38-scipycentos-upgrade-python38-scipy-debuginfocentos-upgrade-python38-setuptoolscentos-upgrade-python38-setuptools-wheelcentos-upgrade-python38-sixcentos-upgrade-python38-testcentos-upgrade-python38-tkintercentos-upgrade-python38-urllib3centos-upgrade-python38-wheelcentos-upgrade-python38-wheel-wheelcentos-upgrade-pyyaml-debugsourcecentos-upgrade-scipy-debugsource | Jun 30, 2021 | Feb 9, 2021 |
| Debian | debian-upgrade-pyyaml | Jul 30, 2024 | Feb 9, 2021 | |
| Dell Powerstore Dsa2024462 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Nov 20, 2024 | |
| Dell Powerstore Dsa2025050 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Jan 28, 2025 | |
| Freebsd | freebsd-upgrade-package-py36-yamlfreebsd-upgrade-package-py37-yamlfreebsd-upgrade-package-py38-yamlfreebsd-upgrade-package-py39-yaml | Nov 4, 2022 | Jun 2, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-python-pyyaml | Feb 27, 2024 | Feb 9, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-pyyaml | May 19, 2021 | Feb 9, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-python2-pyyamlhuawei-euleros-2_0_sp8-upgrade-python3-pyyaml | Feb 2, 2021 | Feb 1, 2021 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-python3-pyyaml | Jun 2, 2021 | Feb 9, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-legacy-library-python-pyyaml-34-5-3-1-11-4-23-0-1-69-1oracle-solaris-11-4-upgrade-legacy-library-python-pyyaml-35-5-3-1-11-4-23-0-1-69-1oracle-solaris-11-4-upgrade-library-python-pyyaml-27-5-3-1-11-4-23-0-1-69-1oracle-solaris-11-4-upgrade-library-python-pyyaml-34-5-3-1-11-4-23-0-1-69-1oracle-solaris-11-4-upgrade-library-python-pyyaml-35-5-3-1-11-4-23-0-1-69-1oracle-solaris-11-4-upgrade-library-python-pyyaml-37-5-3-1-11-4-23-0-1-69-1oracle-solaris-11-4-upgrade-library-python-pyyaml-39-5-4-1-11-4-33-0-1-94-0oracle-solaris-11-4-upgrade-library-python-pyyaml-5-3-1-11-4-23-0-1-69-1 | Mar 17, 2021 | Feb 9, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-python38oracle-linux-upgrade-python38-asn1cryptooracle-linux-upgrade-python38-babeloracle-linux-upgrade-python38-cffioracle-linux-upgrade-python38-chardetoracle-linux-upgrade-python38-cryptographyoracle-linux-upgrade-python38-cythonoracle-linux-upgrade-python38-debugoracle-linux-upgrade-python38-develoracle-linux-upgrade-python38-idleoracle-linux-upgrade-python38-idnaoracle-linux-upgrade-python38-jinja2oracle-linux-upgrade-python38-libsoracle-linux-upgrade-python38-lxmloracle-linux-upgrade-python38-markupsafeoracle-linux-upgrade-python38-mod-wsgioracle-linux-upgrade-python38-numpyoracle-linux-upgrade-python38-numpy-docoracle-linux-upgrade-python38-numpy-f2pyoracle-linux-upgrade-python38-piporacle-linux-upgrade-python38-pip-wheeloracle-linux-upgrade-python38-plyoracle-linux-upgrade-python38-psutiloracle-linux-upgrade-python38-psycopg2oracle-linux-upgrade-python38-psycopg2-docoracle-linux-upgrade-python38-psycopg2-testsoracle-linux-upgrade-python38-pycparseroracle-linux-upgrade-python38-pymysqloracle-linux-upgrade-python38-pysocksoracle-linux-upgrade-python38-pytzoracle-linux-upgrade-python38-pyyamloracle-linux-upgrade-python38-requestsoracle-linux-upgrade-python38-rpm-macrosoracle-linux-upgrade-python38-scipyoracle-linux-upgrade-python38-setuptoolsoracle-linux-upgrade-python38-setuptools-wheeloracle-linux-upgrade-python38-sixoracle-linux-upgrade-python38-testoracle-linux-upgrade-python38-tkinteroracle-linux-upgrade-python38-urllib3oracle-linux-upgrade-python38-wheeloracle-linux-upgrade-python38-wheel-wheel | Jul 2, 2021 | Jul 22, 2020 |
| Redhat_linux | redhat-upgrade-cython-debugsourceredhat-upgrade-numpy-debugsourceredhat-upgrade-python-cffi-debugsourceredhat-upgrade-python-cryptography-debugsourceredhat-upgrade-python-lxml-debugsourceredhat-upgrade-python-markupsafe-debugsourceredhat-upgrade-python-psutil-debugsourceredhat-upgrade-python-psycopg2-debugsourceredhat-upgrade-python38redhat-upgrade-python38-asn1cryptoredhat-upgrade-python38-atomicwritesredhat-upgrade-python38-attrsredhat-upgrade-python38-babelredhat-upgrade-python38-cffiredhat-upgrade-python38-cffi-debuginforedhat-upgrade-python38-chardetredhat-upgrade-python38-cryptographyredhat-upgrade-python38-cryptography-debuginforedhat-upgrade-python38-cythonredhat-upgrade-python38-cython-debuginforedhat-upgrade-python38-debugredhat-upgrade-python38-debuginforedhat-upgrade-python38-debugsourceredhat-upgrade-python38-develredhat-upgrade-python38-idleredhat-upgrade-python38-idnaredhat-upgrade-python38-jinja2redhat-upgrade-python38-libsredhat-upgrade-python38-lxmlredhat-upgrade-python38-lxml-debuginforedhat-upgrade-python38-markupsaferedhat-upgrade-python38-markupsafe-debuginforedhat-upgrade-python38-mod_wsgiredhat-upgrade-python38-more-itertoolsredhat-upgrade-python38-numpyredhat-upgrade-python38-numpy-debuginforedhat-upgrade-python38-numpy-docredhat-upgrade-python38-numpy-f2pyredhat-upgrade-python38-packagingredhat-upgrade-python38-pipredhat-upgrade-python38-pip-wheelredhat-upgrade-python38-pluggyredhat-upgrade-python38-plyredhat-upgrade-python38-psutilredhat-upgrade-python38-psutil-debuginforedhat-upgrade-python38-psycopg2redhat-upgrade-python38-psycopg2-debuginforedhat-upgrade-python38-psycopg2-docredhat-upgrade-python38-psycopg2-testsredhat-upgrade-python38-pyredhat-upgrade-python38-pycparserredhat-upgrade-python38-pymysqlredhat-upgrade-python38-pyparsingredhat-upgrade-python38-pysocksredhat-upgrade-python38-pytestredhat-upgrade-python38-pytzredhat-upgrade-python38-pyyamlredhat-upgrade-python38-pyyaml-debuginforedhat-upgrade-python38-requestsredhat-upgrade-python38-rpm-macrosredhat-upgrade-python38-scipyredhat-upgrade-python38-scipy-debuginforedhat-upgrade-python38-setuptoolsredhat-upgrade-python38-setuptools-wheelredhat-upgrade-python38-sixredhat-upgrade-python38-testredhat-upgrade-python38-tkinterredhat-upgrade-python38-urllib3redhat-upgrade-python38-wcwidthredhat-upgrade-python38-wheelredhat-upgrade-python38-wheel-wheelredhat-upgrade-pyyaml-debugsourceredhat-upgrade-scipy-debugsource | Jun 30, 2021 | Feb 9, 2021 | |
| Rocky_linux | rocky-upgrade-cython-debugsourcerocky-upgrade-numpy-debugsourcerocky-upgrade-python-cffi-debugsourcerocky-upgrade-python-cryptography-debugsourcerocky-upgrade-python-lxml-debugsourcerocky-upgrade-python-markupsafe-debugsourcerocky-upgrade-python-psutil-debugsourcerocky-upgrade-python-psycopg2-debugsourcerocky-upgrade-python38rocky-upgrade-python38-cffirocky-upgrade-python38-cffi-debuginforocky-upgrade-python38-cryptographyrocky-upgrade-python38-cryptography-debuginforocky-upgrade-python38-cythonrocky-upgrade-python38-cython-debuginforocky-upgrade-python38-debugrocky-upgrade-python38-debuginforocky-upgrade-python38-debugsourcerocky-upgrade-python38-develrocky-upgrade-python38-idlerocky-upgrade-python38-libsrocky-upgrade-python38-lxmlrocky-upgrade-python38-lxml-debuginforocky-upgrade-python38-markupsaferocky-upgrade-python38-markupsafe-debuginforocky-upgrade-python38-mod_wsgirocky-upgrade-python38-numpyrocky-upgrade-python38-numpy-debuginforocky-upgrade-python38-numpy-f2pyrocky-upgrade-python38-psutilrocky-upgrade-python38-psutil-debuginforocky-upgrade-python38-psycopg2rocky-upgrade-python38-psycopg2-debuginforocky-upgrade-python38-psycopg2-docrocky-upgrade-python38-psycopg2-testsrocky-upgrade-python38-pyyamlrocky-upgrade-python38-pyyaml-debuginforocky-upgrade-python38-scipyrocky-upgrade-python38-scipy-debuginforocky-upgrade-python38-testrocky-upgrade-python38-tkinterrocky-upgrade-pyyaml-debugsourcerocky-upgrade-scipy-debugsource | May 5, 2022 | Feb 9, 2021 | |
| Suse | — | suse-upgrade-python-pyyamlsuse-upgrade-python2-pyyamlsuse-upgrade-python3-pyyaml | Mar 31, 2021 | Feb 9, 2021 |
| Ubuntu | ubuntu-upgrade-python-yamlubuntu-upgrade-python3-yaml | May 11, 2021 | Feb 9, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Feb 9, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub