CVE-2020-14343: PyYAML Arbitrary Code Execution
Summary
CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader... Affects pyyaml versions < 5.4. Fixed in 5.4. How to fix ↓
Also tracked for
- py3-yaml · Alpine:v3.11
The same CVE-2020-14343 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyYAML is a Python library that allows parsing and emitting YAML files. It is widely used in applications that require YAML processing. However, versions before 5.4 are vulnerable to arbitrary code execution when processing untrusted YAML files. This vulnerability can be exploited through the full_load method or with the FullLoader loader, allowing an attacker to execute arbitrary code on the system. The vulnerability stems from an incomplete fix for CVE-2020-1747.
Vulnerability Detail
The vulnerability in PyYAML allows an attacker to execute arbitrary code by abusing the python/object/new constructor. When processing untrusted YAML files, the library fails to properly sanitize input, leading to code execution. This flaw poses a significant risk to applications that use PyYAML to process untrusted input, as an attacker can take control of the system and perform unauthorized actions. It is crucial to update to version 5.4 or newer to mitigate this vulnerability.
How To Fix
Minimum fixed version
5.4
This is the first release that contains the fix.
pip install --upgrade "pyyaml==5.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in PyYAML versions before 5.4 allows arbitrary code execution when processing untrusted YAML files. It is crucial to update to version 5.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyyaml →
FAQ
PyYAML is a Python library that allows parsing and emitting YAML files. It is commonly used in applications that require YAML processing.
This vulnerability allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. It can lead to unauthorized access, data leakage, and potential system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
Currently, there is no known workaround for this vulnerability. It is recommended to update PyYAML to version 5.4 or later to mitigate the risk.
You can find more information about this vulnerability in the PyPA Advisory Database at https://github.com/pypa/advisory-database/blob/main/vulns/pyyaml/PYSEC-2021-142.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for pyyaml.
