vulnerability
Red Hat: CVE-2019-20477: CVE-2019-20477 PyYAML: command execution through python/object/apply constructor in FullLoader (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | 2020-02-19 | 2020-11-05 | 2023-12-15 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
2020-02-19
Added
2020-11-05
Modified
2023-12-15
Description
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Solution(s)
redhat-upgrade-cython-debugsourceredhat-upgrade-numpy-debugsourceredhat-upgrade-python-cffi-debugsourceredhat-upgrade-python-cryptography-debugsourceredhat-upgrade-python-lxml-debugsourceredhat-upgrade-python-markupsafe-debugsourceredhat-upgrade-python-psutil-debugsourceredhat-upgrade-python-psycopg2-debugsourceredhat-upgrade-python38redhat-upgrade-python38-asn1cryptoredhat-upgrade-python38-babelredhat-upgrade-python38-cffiredhat-upgrade-python38-cffi-debuginforedhat-upgrade-python38-chardetredhat-upgrade-python38-cryptographyredhat-upgrade-python38-cryptography-debuginforedhat-upgrade-python38-cythonredhat-upgrade-python38-cython-debuginforedhat-upgrade-python38-debugredhat-upgrade-python38-debuginforedhat-upgrade-python38-debugsourceredhat-upgrade-python38-develredhat-upgrade-python38-idleredhat-upgrade-python38-idnaredhat-upgrade-python38-jinja2redhat-upgrade-python38-libsredhat-upgrade-python38-lxmlredhat-upgrade-python38-lxml-debuginforedhat-upgrade-python38-markupsaferedhat-upgrade-python38-markupsafe-debuginforedhat-upgrade-python38-mod_wsgiredhat-upgrade-python38-numpyredhat-upgrade-python38-numpy-debuginforedhat-upgrade-python38-numpy-docredhat-upgrade-python38-numpy-f2pyredhat-upgrade-python38-pipredhat-upgrade-python38-pip-wheelredhat-upgrade-python38-plyredhat-upgrade-python38-psutilredhat-upgrade-python38-psutil-debuginforedhat-upgrade-python38-psycopg2redhat-upgrade-python38-psycopg2-debuginforedhat-upgrade-python38-psycopg2-docredhat-upgrade-python38-psycopg2-testsredhat-upgrade-python38-pycparserredhat-upgrade-python38-pymysqlredhat-upgrade-python38-pysocksredhat-upgrade-python38-pytzredhat-upgrade-python38-pyyamlredhat-upgrade-python38-pyyaml-debuginforedhat-upgrade-python38-requestsredhat-upgrade-python38-rpm-macrosredhat-upgrade-python38-scipyredhat-upgrade-python38-scipy-debuginforedhat-upgrade-python38-setuptoolsredhat-upgrade-python38-setuptools-wheelredhat-upgrade-python38-sixredhat-upgrade-python38-testredhat-upgrade-python38-tkinterredhat-upgrade-python38-urllib3redhat-upgrade-python38-wheelredhat-upgrade-python38-wheel-wheelredhat-upgrade-pyyaml-debugsourceredhat-upgrade-scipy-debugsource
References
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.