CVE-2020-14343: PyYAML Improper Input Validation
Summary
CVE-2020-14343: Improper Input Validation in PyYAML. Affects pyyaml versions < 5.4. Fixed in 5.4. How to fix ↓
Also tracked for
- py3-yaml · Alpine:v3.11
The same CVE-2020-14343 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyYAML is a Python library used for parsing and emitting YAML (YAML Ain't Markup Language) data. It provides functionality to read and write YAML files, making it easier to work with structured data. However, versions before 5.4 of PyYAML are vulnerable to an improper input validation issue. This vulnerability allows an attacker to execute arbitrary code on a system by abusing the python/object/new constructor. Applications that process untrusted YAML files using the full_load method or the FullLoader loader are susceptible to this flaw.
Vulnerability Detail
The vulnerability in PyYAML arises from an incomplete fix for CVE-2020-1747. When processing untrusted YAML files, the library fails to properly validate input, leading to arbitrary code execution. By exploiting the python/object/new constructor, an attacker can execute malicious code on the system. This vulnerability has a CVSS score of 9.8, indicating its critical severity. It is crucial for applications that use PyYAML to process untrusted input to address this vulnerability promptly to prevent potential code execution and system compromise.
How To Fix
Minimum fixed version
5.4
This is the first release that contains the fix.
pip install --upgrade "pyyaml==5.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading PyYAML is not immediately feasible, it is recommended to avoid processing untrusted YAML files using the full_load method or the FullLoader loader. Instead, consider using alternative methods or parsers that are not affected by this vulnerability.
Conclusion
The vulnerability in PyYAML (CVE-2020-14343) exposes applications to arbitrary code execution when processing untrusted YAML files. It is critical to upgrade to PyYAML version 5.4 or later to mitigate this vulnerability. Alternatively, avoid processing untrusted YAML files using the affected methods. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is a Python library used for parsing and emitting YAML data. It simplifies working with structured data in YAML format.
This vulnerability allows an attacker to execute arbitrary code on a system by abusing the python/object/new constructor. It can lead to system compromise and unauthorized access.
Versions before 5.4 of PyYAML are affected by this vulnerability. It is recommended to upgrade to version 5.4 or later.
To fix this vulnerability, upgrade PyYAML to version 5.4 or later using the 'pip install --upgrade pyyaml' command.
As a workaround, avoid processing untrusted YAML files using the full_load method or the FullLoader loader until PyYAML is upgraded.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
