PYSEC-2020-195

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in…

Not rated yet Withdrawn Mar 14, 2023 PyPI

Severity: Not rated yet; No source has published a CVSS score yet
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 5.2b1; Upgrade pyyaml to this version or later

Description

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Affected versions

PyPI

Package	Vulnerable	Fixed in
pyyaml	`>= 5.1, < 5.2b1`	`5.2b1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

pyyaml PyPI → `5.2b1`

pip

pip install --upgrade "pyyaml>=5.2b1"

poetry

poetry add "pyyaml>=5.2b1"

uv

uv add "pyyaml>=5.2b1"

References

Timeline

Feb 19, 2020 Published
Mar 14, 2023 Last updated by the source
Mar 14, 2023 Withdrawn

Advisory	Severity	Why it's related
GHSA-8q59-q68h-6hv4 Improper Input Validation in PyYAML	Critical	Also affects pyyaml
GHSA-6757-jp84-gxfx Improper Input Validation in PyYAML	Critical	Also affects pyyaml
GHSA-3pqx-4fqf-j49f Deserialization of Untrusted Data in PyYAML	Critical	Also affects pyyaml
GHSA-rprw-h62v-c2w7 PyYAML insecurely deserializes YAML strings leading to arbitrary code execution	Critical	Also affects pyyaml

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor