kritisch
CVE-2019-20477
PyYAML: command execution through python/object/apply constructor in FullLoader
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Photon OS. Niedriger laut Red Hat (mittel), AlmaLinux (mittel), Oracle (mittel), Rocky Linux (mittel).
Beschreibung
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-4.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-5.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-4.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.2 |
| alma 8 | python38:3.8::python38-Cython, python38:3.8::python38-asn1crypto, python38:3.8::python38-cffi und 13 weitere | 0.29.14-4.module_el8.6.0+2778+cd494b30 und 13 weitere |
| debian 11 | pyyaml | 5.2-1 |
| debian 12 | pyyaml | 5.2-1 |
| debian 13 | pyyaml | 5.2-1 |
| debian 14 | pyyaml | 5.2-1 |
| echo | pyyaml | 5.2-1 |
| Oracle Linux 8 | python38, python38-Cython, python38-PyMySQL und 39 weitere | 3.8.3-3.module+el8.3.0+7824+e0098946 und 27 weitere |
| Red Hat | PyYAML | kein Fix angegeben |
Alle 100 Einträge aus 14 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-4.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-5.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-4.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.2 |
| alma 8 | python38:3.8::python38-Cython | 0.29.14-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-asn1crypto | 1.2.0-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-cffi | 1.13.2-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-chardet | 3.0.4-19.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-cryptography | 2.8-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-idna | 2.8-6.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-markupsafe | 1.1.1-6.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-mod_wsgi | 4.6.8-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2 | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2-doc | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2-tests | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pycparser | 2.19-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pysocks | 1.7.1-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pytz | 2019.3-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-requests | 2.22.0-9.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-scipy | 1.3.1-4.module_el8.6.0+2778+cd494b30 |
| debian 11 | pyyaml | 5.2-1 |
| debian 12 | pyyaml | 5.2-1 |
| debian 13 | pyyaml | 5.2-1 |
| debian 14 | pyyaml | 5.2-1 |
| echo | pyyaml | 5.2-1 |
| Oracle Linux 8 | python38 | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-Cython | 0.29.14-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-PyMySQL | 0.9.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-asn1crypto | 1.2.0-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-babel | 2.7.0-10.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-cffi | 1.13.2-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-chardet | 3.0.4-19.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-cryptography | 2.8-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-debug | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-devel | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-idle | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-idna | 2.8-6.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-jinja2 | 2.10.3-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-libs | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-lxml | 4.4.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-markupsafe | 1.1.1-6.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-mod_wsgi | 4.6.8-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy-doc | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy-f2py | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pip | 19.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pip-wheel | 19.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-ply | 3.11-8.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psutil | 5.6.4-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2 | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2-doc | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2-tests | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pycparser | 2.19-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pysocks | 1.7.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pytz | 2019.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pyyaml | 5.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-requests | 2.22.0-9.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-rpm-macros | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-scipy | 1.3.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-setuptools | 41.6.0-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-setuptools-wheel | 41.6.0-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-six | 1.12.0-9.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-test | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-tkinter | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-urllib3 | 1.25.7-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-wheel | 0.33.6-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-wheel-wheel | 0.33.6-5.module+el8.3.0+7824+e0098946 |
| Red Hat | PyYAML | kein Fix angegeben |
| rocky 8 | python38:3.8::python38-Cython | 0.29.14-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-asn1crypto | 1.2.0-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-babel | 2.7.0-10.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-cffi | 1.13.2-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-chardet | 3.0.4-19.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-cryptography | 2.8-3.module+el8.5.0+672+ab6eb015 |
| rocky 8 | python38:3.8::python38-idna | 2.8-6.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-jinja2 | 2.10.3-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-markupsafe | 1.1.1-6.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-mod_wsgi | 4.6.8-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy-doc | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy-f2py | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pip | 19.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pip-wheel | 19.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-psutil | 5.6.4-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-psycopg2 | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-psycopg2-doc | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-psycopg2-tests | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-pycparser | 2.19-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pysocks | 1.7.1-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pytz | 2019.3-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pyyaml | 5.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-requests | 2.22.0-9.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-scipy | 1.3.1-4.module+el8.5.0+672+ab6eb015 |
| rocky 8 | python38:3.8::python38-setuptools | 41.6.0-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-setuptools-wheel | 41.6.0-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-urllib3 | 1.25.7-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-wheel | 0.33.6-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-wheel-wheel | 0.33.6-5.module+el8.4.0+570+c2eaf144 |
| seal pip::Seal Security Database | pyyaml | 5.1+sp999 |
| seal pip::Seal Security Database | seal-pyyaml | 5.1+sp999 |
Referenzen
- https://access.redhat.com/errata/RHSA-2020:4641
- https://access.redhat.com/security/cve/CVE-2019-20477
- https://bugzilla.redhat.com/1806005
- https://bugzilla.redhat.com/1807367
- https://bugzilla.redhat.com/1809065
- https://bugzilla.redhat.com/1815643
- https://bugzilla.redhat.com/1847416
- https://bugzilla.redhat.com/1854926
Alle 36 Referenzen
- https://bugzilla.redhat.com/1856481
- https://bugzilla.redhat.com/show_bug.cgi?id=1806005
- https://bugzilla.redhat.com/show_bug.cgi?id=1807367
- https://bugzilla.redhat.com/show_bug.cgi?id=1809065
- https://bugzilla.redhat.com/show_bug.cgi?id=1815643
- https://bugzilla.redhat.com/show_bug.cgi?id=1847416
- https://bugzilla.redhat.com/show_bug.cgi?id=1854926
- https://bugzilla.redhat.com/show_bug.cgi?id=1856481
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20477
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492
- https://errata.almalinux.org/8/ALSA-2020-4641.html
- https://errata.rockylinux.org/RLSA-2020:4641
- https://github.com/advisories/GHSA-3pqx-4fqf-j49f
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-176.yaml
- https://github.com/yaml/pyyaml
- https://github.com/yaml/pyyaml/blob/master/CHANGES
- https://linux.oracle.com/cve/CVE-2019-20477.html
- https://linux.oracle.com/errata/ELSA-2020-4641.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H/
- https://nvd.nist.gov/vuln/detail/CVE-2019-20477
- https://www.cve.org/CVERecord?id=CVE-2019-20477
- https://www.exploit-db.com/download/47655