crítica
CVE-2019-20477
PyYAML: command execution through python/object/apply constructor in FullLoader
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Photon OS. Más baja según Red Hat (media), AlmaLinux (media), Oracle (media), Rocky Linux (media).
Descripción
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-4.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-5.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-4.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.2 |
| alma 8 | python38:3.8::python38-Cython, python38:3.8::python38-asn1crypto, python38:3.8::python38-cffi y 13 más | 0.29.14-4.module_el8.6.0+2778+cd494b30 y 13 más |
| debian 11 | pyyaml | 5.2-1 |
| debian 12 | pyyaml | 5.2-1 |
| debian 13 | pyyaml | 5.2-1 |
| debian 14 | pyyaml | 5.2-1 |
| echo | pyyaml | 5.2-1 |
| Oracle Linux 8 | python38, python38-Cython, python38-PyMySQL y 39 más | 3.8.3-3.module+el8.3.0+7824+e0098946 y 27 más |
| Red Hat | PyYAML | sin corrección indicada |
Mostrar las 100 entradas de 14 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-4.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-5.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-4.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.2 |
| alma 8 | python38:3.8::python38-Cython | 0.29.14-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-asn1crypto | 1.2.0-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-cffi | 1.13.2-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-chardet | 3.0.4-19.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-cryptography | 2.8-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-idna | 2.8-6.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-markupsafe | 1.1.1-6.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-mod_wsgi | 4.6.8-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2 | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2-doc | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2-tests | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pycparser | 2.19-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pysocks | 1.7.1-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pytz | 2019.3-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-requests | 2.22.0-9.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-scipy | 1.3.1-4.module_el8.6.0+2778+cd494b30 |
| debian 11 | pyyaml | 5.2-1 |
| debian 12 | pyyaml | 5.2-1 |
| debian 13 | pyyaml | 5.2-1 |
| debian 14 | pyyaml | 5.2-1 |
| echo | pyyaml | 5.2-1 |
| Oracle Linux 8 | python38 | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-Cython | 0.29.14-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-PyMySQL | 0.9.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-asn1crypto | 1.2.0-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-babel | 2.7.0-10.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-cffi | 1.13.2-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-chardet | 3.0.4-19.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-cryptography | 2.8-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-debug | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-devel | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-idle | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-idna | 2.8-6.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-jinja2 | 2.10.3-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-libs | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-lxml | 4.4.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-markupsafe | 1.1.1-6.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-mod_wsgi | 4.6.8-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy-doc | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy-f2py | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pip | 19.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pip-wheel | 19.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-ply | 3.11-8.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psutil | 5.6.4-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2 | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2-doc | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2-tests | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pycparser | 2.19-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pysocks | 1.7.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pytz | 2019.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pyyaml | 5.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-requests | 2.22.0-9.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-rpm-macros | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-scipy | 1.3.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-setuptools | 41.6.0-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-setuptools-wheel | 41.6.0-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-six | 1.12.0-9.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-test | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-tkinter | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-urllib3 | 1.25.7-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-wheel | 0.33.6-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-wheel-wheel | 0.33.6-5.module+el8.3.0+7824+e0098946 |
| Red Hat | PyYAML | sin corrección indicada |
| rocky 8 | python38:3.8::python38-Cython | 0.29.14-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-asn1crypto | 1.2.0-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-babel | 2.7.0-10.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-cffi | 1.13.2-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-chardet | 3.0.4-19.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-cryptography | 2.8-3.module+el8.5.0+672+ab6eb015 |
| rocky 8 | python38:3.8::python38-idna | 2.8-6.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-jinja2 | 2.10.3-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-markupsafe | 1.1.1-6.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-mod_wsgi | 4.6.8-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy-doc | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy-f2py | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pip | 19.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pip-wheel | 19.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-psutil | 5.6.4-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-psycopg2 | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-psycopg2-doc | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-psycopg2-tests | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-pycparser | 2.19-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pysocks | 1.7.1-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pytz | 2019.3-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pyyaml | 5.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-requests | 2.22.0-9.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-scipy | 1.3.1-4.module+el8.5.0+672+ab6eb015 |
| rocky 8 | python38:3.8::python38-setuptools | 41.6.0-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-setuptools-wheel | 41.6.0-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-urllib3 | 1.25.7-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-wheel | 0.33.6-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-wheel-wheel | 0.33.6-5.module+el8.4.0+570+c2eaf144 |
| seal pip::Seal Security Database | pyyaml | 5.1+sp999 |
| seal pip::Seal Security Database | seal-pyyaml | 5.1+sp999 |
Referencias
- https://access.redhat.com/errata/RHSA-2020:4641
- https://access.redhat.com/security/cve/CVE-2019-20477
- https://bugzilla.redhat.com/1806005
- https://bugzilla.redhat.com/1807367
- https://bugzilla.redhat.com/1809065
- https://bugzilla.redhat.com/1815643
- https://bugzilla.redhat.com/1847416
- https://bugzilla.redhat.com/1854926
Las 36 referencias
- https://bugzilla.redhat.com/1856481
- https://bugzilla.redhat.com/show_bug.cgi?id=1806005
- https://bugzilla.redhat.com/show_bug.cgi?id=1807367
- https://bugzilla.redhat.com/show_bug.cgi?id=1809065
- https://bugzilla.redhat.com/show_bug.cgi?id=1815643
- https://bugzilla.redhat.com/show_bug.cgi?id=1847416
- https://bugzilla.redhat.com/show_bug.cgi?id=1854926
- https://bugzilla.redhat.com/show_bug.cgi?id=1856481
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20477
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492
- https://errata.almalinux.org/8/ALSA-2020-4641.html
- https://errata.rockylinux.org/RLSA-2020:4641
- https://github.com/advisories/GHSA-3pqx-4fqf-j49f
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-176.yaml
- https://github.com/yaml/pyyaml
- https://github.com/yaml/pyyaml/blob/master/CHANGES
- https://linux.oracle.com/cve/CVE-2019-20477.html
- https://linux.oracle.com/errata/ELSA-2020-4641.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H/
- https://nvd.nist.gov/vuln/detail/CVE-2019-20477
- https://www.cve.org/CVERecord?id=CVE-2019-20477
- https://www.exploit-db.com/download/47655