critique
CVE-2019-20477
PyYAML: command execution through python/object/apply constructor in FullLoader
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon Red Hat (moyenne), AlmaLinux (moyenne), Oracle (moyenne), Rocky Linux (moyenne).
Description
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-4.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-5.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-4.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.2 |
| alma 8 | python38:3.8::python38-Cython, python38:3.8::python38-asn1crypto, python38:3.8::python38-cffi et 13 autres | 0.29.14-4.module_el8.6.0+2778+cd494b30 et 13 autres |
| debian 11 | pyyaml | 5.2-1 |
| debian 12 | pyyaml | 5.2-1 |
| debian 13 | pyyaml | 5.2-1 |
| debian 14 | pyyaml | 5.2-1 |
| echo | pyyaml | 5.2-1 |
| Oracle Linux 8 | python38, python38-Cython, python38-PyMySQL et 39 autres | 3.8.3-3.module+el8.3.0+7824+e0098946 et 27 autres |
| Red Hat | PyYAML | pas de correctif indiqué |
Afficher les 100 entrées de 14 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | PyYAML | 3.12-4.ph1 |
| Photon OS 2.0 | PyYAML | 3.12-5.ph2 |
| Photon OS 3.0 | PyYAML | 3.13-4.ph3 |
| pip::GitHub Security Advisory pip | pyyaml | 5.2 |
| alma 8 | python38:3.8::python38-Cython | 0.29.14-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-asn1crypto | 1.2.0-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-cffi | 1.13.2-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-chardet | 3.0.4-19.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-cryptography | 2.8-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-idna | 2.8-6.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-markupsafe | 1.1.1-6.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-mod_wsgi | 4.6.8-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2 | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2-doc | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-psycopg2-tests | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pycparser | 2.19-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pysocks | 1.7.1-4.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-pytz | 2019.3-3.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-requests | 2.22.0-9.module_el8.6.0+2778+cd494b30 |
| alma 8 | python38:3.8::python38-scipy | 1.3.1-4.module_el8.6.0+2778+cd494b30 |
| debian 11 | pyyaml | 5.2-1 |
| debian 12 | pyyaml | 5.2-1 |
| debian 13 | pyyaml | 5.2-1 |
| debian 14 | pyyaml | 5.2-1 |
| echo | pyyaml | 5.2-1 |
| Oracle Linux 8 | python38 | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-Cython | 0.29.14-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-PyMySQL | 0.9.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-asn1crypto | 1.2.0-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-babel | 2.7.0-10.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-cffi | 1.13.2-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-chardet | 3.0.4-19.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-cryptography | 2.8-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-debug | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-devel | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-idle | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-idna | 2.8-6.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-jinja2 | 2.10.3-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-libs | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-lxml | 4.4.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-markupsafe | 1.1.1-6.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-mod_wsgi | 4.6.8-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy-doc | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-numpy-f2py | 1.17.3-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pip | 19.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pip-wheel | 19.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-ply | 3.11-8.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psutil | 5.6.4-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2 | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2-doc | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-psycopg2-tests | 2.8.4-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pycparser | 2.19-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pysocks | 1.7.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pytz | 2019.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-pyyaml | 5.3.1-1.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-requests | 2.22.0-9.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-rpm-macros | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-scipy | 1.3.1-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-setuptools | 41.6.0-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-setuptools-wheel | 41.6.0-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-six | 1.12.0-9.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-test | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-tkinter | 3.8.3-3.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-urllib3 | 1.25.7-4.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-wheel | 0.33.6-5.module+el8.3.0+7824+e0098946 |
| Oracle Linux 8 | python38-wheel-wheel | 0.33.6-5.module+el8.3.0+7824+e0098946 |
| Red Hat | PyYAML | pas de correctif indiqué |
| rocky 8 | python38:3.8::python38-Cython | 0.29.14-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-asn1crypto | 1.2.0-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-babel | 2.7.0-10.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-cffi | 1.13.2-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-chardet | 3.0.4-19.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-cryptography | 2.8-3.module+el8.5.0+672+ab6eb015 |
| rocky 8 | python38:3.8::python38-idna | 2.8-6.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-jinja2 | 2.10.3-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-markupsafe | 1.1.1-6.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-mod_wsgi | 4.6.8-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy-doc | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-numpy-f2py | 1.17.3-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pip | 19.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pip-wheel | 19.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-psutil | 5.6.4-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-psycopg2 | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-psycopg2-doc | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-psycopg2-tests | 2.8.4-4.module+el8.6.0+794+eba84017 |
| rocky 8 | python38:3.8::python38-pycparser | 2.19-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pysocks | 1.7.1-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pytz | 2019.3-3.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-pyyaml | 5.3.1-1.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-requests | 2.22.0-9.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-scipy | 1.3.1-4.module+el8.5.0+672+ab6eb015 |
| rocky 8 | python38:3.8::python38-setuptools | 41.6.0-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-setuptools-wheel | 41.6.0-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-urllib3 | 1.25.7-4.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-wheel | 0.33.6-5.module+el8.4.0+570+c2eaf144 |
| rocky 8 | python38:3.8::python38-wheel-wheel | 0.33.6-5.module+el8.4.0+570+c2eaf144 |
| seal pip::Seal Security Database | pyyaml | 5.1+sp999 |
| seal pip::Seal Security Database | seal-pyyaml | 5.1+sp999 |
Références
- https://access.redhat.com/errata/RHSA-2020:4641
- https://access.redhat.com/security/cve/CVE-2019-20477
- https://bugzilla.redhat.com/1806005
- https://bugzilla.redhat.com/1807367
- https://bugzilla.redhat.com/1809065
- https://bugzilla.redhat.com/1815643
- https://bugzilla.redhat.com/1847416
- https://bugzilla.redhat.com/1854926
Les 36 références
- https://bugzilla.redhat.com/1856481
- https://bugzilla.redhat.com/show_bug.cgi?id=1806005
- https://bugzilla.redhat.com/show_bug.cgi?id=1807367
- https://bugzilla.redhat.com/show_bug.cgi?id=1809065
- https://bugzilla.redhat.com/show_bug.cgi?id=1815643
- https://bugzilla.redhat.com/show_bug.cgi?id=1847416
- https://bugzilla.redhat.com/show_bug.cgi?id=1854926
- https://bugzilla.redhat.com/show_bug.cgi?id=1856481
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20477
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492
- https://errata.almalinux.org/8/ALSA-2020-4641.html
- https://errata.rockylinux.org/RLSA-2020:4641
- https://github.com/advisories/GHSA-3pqx-4fqf-j49f
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-176.yaml
- https://github.com/yaml/pyyaml
- https://github.com/yaml/pyyaml/blob/master/CHANGES
- https://linux.oracle.com/cve/CVE-2019-20477.html
- https://linux.oracle.com/errata/ELSA-2020-4641.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H/
- https://nvd.nist.gov/vuln/detail/CVE-2019-20477
- https://www.cve.org/CVERecord?id=CVE-2019-20477
- https://www.exploit-db.com/download/47655