CVE-2020-1747: PyYAML Arbitrary Code Execution
Summary
CVE-2020-1747: A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoade... Affects pyyaml versions >= 5.1, < 5.3.1. Fixed in 5.3.1. How to fix ↓
Also tracked for
- py3-yaml · Alpine:v3.11
The same CVE-2020-1747 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyYAML is a Python library that allows developers to parse and manipulate YAML (YAML Ain't Markup Language) files. It provides a convenient way to work with structured data in a human-readable format. However, versions before 5.3.1 of PyYAML are vulnerable to arbitrary code execution when processing untrusted YAML files using the full_load method or the FullLoader loader. This vulnerability can be exploited by an attacker to execute arbitrary code on the system by abusing the python/object/new constructor.
Vulnerability Detail
The vulnerability (CVE-2020-1747) in PyYAML arises from a flaw in the library's handling of untrusted input. When processing YAML files, specifically through the full_load method or with the FullLoader loader, an attacker can inject malicious code that will be executed by the system. This can lead to various consequences, including unauthorized access, data manipulation, or even complete compromise of the affected system. It is important to note that this vulnerability only affects PyYAML versions prior to 5.3.1.
How To Fix
Minimum fixed version
5.3.1
This is the first release that contains the fix.
pip install --upgrade "pyyaml==5.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating PyYAML to the latest version is not immediately feasible, a possible workaround is to avoid using the full_load method or the FullLoader loader with untrusted YAML files. Instead, consider using alternative methods or libraries for parsing and processing YAML data until the update can be applied.
Conclusion
The vulnerability (CVE-2020-1747) in PyYAML allows for arbitrary code execution when processing untrusted YAML files. To mitigate this risk, it is crucial to update PyYAML to version 5.3.1 or later. Alternatively, refrain from using the full_load method or the FullLoader loader with untrusted YAML files until the update can be applied. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is a Python library that enables developers to parse and manipulate YAML files, which are commonly used for configuration and data serialization.
The vulnerability allows an attacker to execute arbitrary code on a system that processes untrusted YAML files using PyYAML. This can lead to unauthorized access, data manipulation, or complete compromise of the affected system.
Versions of PyYAML prior to 5.3.1 are vulnerable to this arbitrary code execution flaw.
To fix this vulnerability, update PyYAML to version 5.3.1 or later using the command 'pip install --upgrade pyyaml'.
If updating PyYAML is not immediately possible, it is recommended to avoid using the full_load method or the FullLoader loader with untrusted YAML files until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
