CVE-2020-1747: PyYAML Improper Input Validation
Summary
CVE-2020-1747: Improper Input Validation in PyYAML. Affects pyyaml versions >= 5.1b7, < 5.3.1. Fixed in 5.3.1. How to fix ↓
Also tracked for
- py3-yaml · Alpine:v3.11
The same CVE-2020-1747 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyYAML is an open-source library for parsing and manipulating YAML (YAML Ain't Markup Language) files in Python. It provides functionality to load YAML data into Python objects and serialize Python objects into YAML format. PyYAML is widely used in various applications for processing YAML files. However, versions before 5.3.1 of PyYAML are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in PyYAML (versions before 5.3.1) allows for arbitrary code execution when processing untrusted YAML files using the full_load method or the FullLoader loader. This vulnerability can be exploited by an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. Applications that use PyYAML to process untrusted input are susceptible to this flaw. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
5.3.1
This is the first release that contains the fix.
pip install --upgrade "pyyaml==5.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading PyYAML is not immediately possible, a possible workaround is to avoid using the full_load method or the FullLoader loader with untrusted YAML files. Instead, consider using alternative methods or libraries for parsing and processing YAML data until the PyYAML package can be updated.
Conclusion
In conclusion, PyYAML versions before 5.3.1 are vulnerable to an improper input validation issue that can lead to arbitrary code execution. It is crucial to upgrade to the latest version of PyYAML (5.3.1 or later) to mitigate this vulnerability. If immediate upgrade is not possible, it is advised to avoid using the vulnerable methods or loaders with untrusted YAML files. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is an open-source library for parsing and manipulating YAML files in Python. It provides functionality to load YAML data into Python objects and serialize Python objects into YAML format.
Versions of PyYAML before 5.3.1 are affected by this vulnerability.
An attacker can exploit this vulnerability by providing a specially crafted YAML file that triggers the improper input validation issue in PyYAML. By abusing the python/object/new constructor, the attacker can execute arbitrary code on the system.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to upgrade PyYAML to version 5.3.1 or later. Updating the PyYAML package can be done by running the command 'pip install --upgrade pyyaml'.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
