Class Deserialization Issue in PyYAML 5.1 through 5.1.2
Summary
CVE-2019-20477: PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. Affects pyyaml across 2 version ranges.
< 5.2-1
>= e471e86bf6dabdad45a1438c20a4a5c033eb9034, <= a9b98a3daa43d43afd8051b014d5b4154d141913
Fixed in 5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyYAML is a YAML parser and emitter for Python. It allows developers to easily read and write YAML files, which are commonly used for configuration purposes. PyYAML is widely used in various applications and frameworks. However, versions 5.1 through 5.1.2 of PyYAML suffer from a class deserialization issue, which can lead to security vulnerabilities.
Vulnerability Detail
The vulnerability in PyYAML arises due to insufficient restrictions on the load and load_all functions. This issue allows for class deserialization, which means that an attacker can execute arbitrary code by crafting a malicious YAML file. For example, the Popen class in the subprocess module can be exploited. It is important to note that this vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2017-18342). The impact of this vulnerability can be severe, as it allows for remote code execution and potential compromise of the affected system.
How To Fix
Minimum fixed version
5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pyyamlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading PyYAML to a secure version.
Conclusion
The class deserialization issue in PyYAML versions 5.1 through 5.1.2 poses a significant security risk, allowing for remote code execution. It is crucial to upgrade PyYAML to version 5.2-1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is a YAML parser and emitter for Python. It allows developers to easily read and write YAML files.
Versions 5.1 through 5.1.2 of PyYAML are affected by this vulnerability.
This vulnerability allows for remote code execution and potential compromise of the affected system.
No, there is no known workaround. It is necessary to upgrade PyYAML to a secure version.
To fix this vulnerability, upgrade PyYAML to version 5.2-1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
