Skip to content
Fencer Intel
critical 9.8

CVE-2019-20477 json

Deserialization of Untrusted Data in PyYAML

published 6y ago modified 4mo ago also GHSA-3pqx-4fqf-j49f , PYSEC-2020-176 , EUVD-2020-0159

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.1%
EPSS 5.1% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Patch / fix

  • pypi pyyaml 5.2, 5.2b1
  • pyyaml Debian 14, Debian 13, Debian 12 5.2-1

debian advisories DEBIAN-CVE-2019-20477

  • pytz RHEL 8 2019.3-3.module+el8.2.0+5234+f98739b6
  • babel RHEL 8 2.7.0-10.module+el8.2.0+5234+f98739b6
  • numpy RHEL 8 1.17.3-5.module+el8.3.0+7187+a27ec44b
  • scipy RHEL 8 1.3.1-4.module+el8.2.0+5234+f98739b6
  • Cython RHEL 8 0.29.14-4.module+el8.2.0+5234+f98739b6
  • PyYAML RHEL 8 5.3.1-1.module+el8.3.0+7187+a27ec44b
  • mod_wsgi RHEL 8 4.6.8-3.module+el8.2.0+5234+f98739b6
  • python38 RHEL 8 3.8.3-3.module+el8.3.0+7680+79e7e61a

red hat advisories RHSA-2020:4641

  • python38-cffi AlmaLinux 8 1.13.2-3.module_el8.6.0+2778+cd494b30
  • python38-idna AlmaLinux 8 2.8-6.module_el8.6.0+2778+cd494b30
  • python38-pytz AlmaLinux 8 2019.3-3.module_el8.6.0+2778+cd494b30
  • python38-scipy AlmaLinux 8 1.3.1-4.module_el8.6.0+2778+cd494b30
  • python38-Cython AlmaLinux 8 0.29.14-4.module_el8.6.0+2778+cd494b30
  • python38-chardet AlmaLinux 8 3.0.4-19.module_el8.6.0+2778+cd494b30
  • python38-pysocks AlmaLinux 8 1.7.1-4.module_el8.6.0+2778+cd494b30
  • python38-mod_wsgi AlmaLinux 8 4.6.8-3.module_el8.6.0+2778+cd494b30

almalinux advisories ALSA-2020:4641

  • pytz Rocky Linux 8 2019.3-3.module+el8.4.0+570+c2eaf144
  • babel Rocky Linux 8 2.7.0-10.module+el8.4.0+570+c2eaf144
  • numpy Rocky Linux 8 1.17.3-5.module+el8.4.0+570+c2eaf144
  • scipy Rocky Linux 8 1.3.1-4.module+el8.5.0+672+ab6eb015
  • scipy Rocky Linux 8 1.3.1-4.module+el8.4.0+570+c2eaf144
  • Cython Rocky Linux 8 0.29.14-4.module+el8.4.0+570+c2eaf144
  • PyYAML Rocky Linux 8 5.3.1-1.module+el8.4.0+570+c2eaf144
  • mod_wsgi Rocky Linux 8 4.6.8-3.module+el8.4.0+570+c2eaf144

rocky linux advisories RLSA-2020:4641

Is CVE-2019-20477 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-20477 updated cvss 9.8

PyYAML: command execution through python/object/apply constructor in FullLoader

  • Red Hat Enterprise Linux 6 PyYAML Red Hat OpenStack Platform 10 (Newton) PyYAML Red Hat OpenStack Platform 13 (Queens) PyYAML
    affected: workaround, no fix planned “Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.”
  • Red Hat Quay v3 quay/quay-rhel8 v3.4.0-51, quay/clair-rhel8 v3.4.0-25, quay/quay-builder-rhel8 v3.4.0-18, quay/quay-operator-bundle v3.4.0-89, quay/quay-operator-rhel8 v3.4.0-132, quay/quay-bridge-operator-bundle v3.4.0-3, +5 more
    fixed: vendor fix “Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.” RHSA-2021:0420
  • Red Hat Enterprise Linux AppStream (v. 8) pytz 2019.3-3.module+el8.2.0+5234+f98739b6, scipy 1.3.1-4.module+el8.2.0+5234+f98739b6, babel 2.7.0-10.module+el8.2.0+5234+f98739b6, numpy 1.17.3-5.module+el8.3.0+7187+a27ec44b, PyYAML 5.3.1-1.module+el8.3.0+7187+a27ec44b, Cython 0.29.14-4.module+el8.2.0+5234+f98739b6, +59 more
    fixed: vendor fix “Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.” RHSA-2020:4641
  • Red Hat Enterprise Linux 7 PyYAML Red Hat Enterprise Linux 8 PyYAML, python2-pyyaml, python38-pyyaml, python39-pyyaml Red Hat Software Collections python27-PyYAML, rh-python36-PyYAML, rh-python38-python-pyyaml
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.11% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • exploit-db.com https://www.exploit-db.com/download/47655 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi pyyaml
>=5.1, <5.2
>=5.1, <5.2b1
5.2
5.2b1

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.