{"id":"CVE-2019-20477","published":"2020-02-19T03:09:21Z","modified":"2024-08-05T02:39:10Z","title":"PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class…","vendor":null,"product":null,"tier":"tail","description":{"text":"PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.05114,"percentile":0.92382,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/yaml/pyyaml/blob/master/CHANGES","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/download/47655","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":18.5,"factors":[{"name":"EPSS percentile","points":18.48}]},"affected":[{"ecosystem":"PyPI","package":"pyyaml","vulnerableRanges":[">=5.1, <5.2",">=5.1, <5.2b1"],"patched":["5.2","5.2b1"],"from":["GHSA-3pqx-4fqf-j49f","PYSEC-2020-176"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0159","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pyyaml-cve-2017-18342","parents":[{"from":"CVE-2017-18342","to":"CVE-2019-20477","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.","from":"CVE.org","in":"CVE-2019-20477"}]}],"packageHistory":[{"cve":"CVE-2019-20477","published":"2020-02-19","fixed":"5.2","kev":false},{"cve":"CVE-2020-1747","published":"2020-03-24","fixed":"5.3.1","kev":false,"link":{"from":"CVE-2019-20477","to":"CVE-2020-1747","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pyyaml","fromFixed":"5.2","toFixed":"5.3.1","daysApart":34}]}}],"package":"PyPI:pyyaml"}}