CVE-2019-20477: PyYAML Deserialization of Untrusted Data
Summary
CVE-2019-20477: Deserialization of Untrusted Data in PyYAML. Affects pyyaml versions >= 5.1, < 5.2. Fixed in 5.2. How to fix ↓
Also tracked for
- pyyaml · Debian:11
The same CVE-2019-20477 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PyYAML is a Python library that allows for the parsing and serialization of YAML (YAML Ain't Markup Language) data. It provides a convenient way to work with YAML files, which are commonly used for configuration and data exchange. PyYAML versions 5.1 through 5.1.2 are affected by a vulnerability that allows for the deserialization of untrusted data. This vulnerability stems from a class deserialization issue, where certain classes can be instantiated and executed when loading YAML data. The incomplete fix for CVE-2017-18342 is the root cause of this vulnerability.
Vulnerability Detail
The vulnerability in PyYAML allows an attacker to execute arbitrary code by providing malicious YAML data. When using the load or load_all functions in PyYAML, an attacker can exploit the deserialization process to instantiate and execute arbitrary classes, potentially leading to remote code execution. This can have severe consequences, including unauthorized access, data manipulation, and system compromise. The vulnerability has a CVSS score of 9.8, indicating a high severity level.
How To Fix
Minimum fixed version
5.2
This is the first release that contains the fix.
pip install --upgrade "pyyaml==5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading PyYAML is not immediately feasible, it is recommended to avoid deserializing untrusted YAML data using the load or load_all functions. Instead, consider using alternative methods for parsing and handling YAML data, or implement strict input validation and sanitization when working with untrusted YAML sources.
Conclusion
The PyYAML vulnerability (CVE-2019-20477) allows for the deserialization of untrusted data, potentially leading to remote code execution. It is crucial to upgrade PyYAML to version 5.2 or later to mitigate this vulnerability. If immediate upgrade is not possible, alternative methods for handling YAML data or strict input validation should be implemented. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is a Python library for parsing and serializing YAML data. It provides a convenient way to work with YAML files, commonly used for configuration and data exchange.
PyYAML versions 5.1 through 5.1.2 are affected by this vulnerability.
The vulnerability allows an attacker to execute arbitrary code by providing malicious YAML data. This can lead to unauthorized access, data manipulation, and system compromise.
Yes, upgrading PyYAML to version 5.2 or later fixes this vulnerability.
As a workaround, it is recommended to avoid deserializing untrusted YAML data using the load or load_all functions. Implement strict input validation and sanitization when working with untrusted YAML sources.
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
