Skip to content
Fencer Intel
critical 9.8

CVE-2020-1747 json

Improper Input Validation in PyYAML

published 6y ago modified 4mo ago also GHSA-6757-jp84-gxfx , PYSEC-2020-96 , EUVD-2020-0160

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.4%
EPSS 5.4% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Patch / fix

  • pypi pyyaml 5.3.1
  • pyyaml pyyaml 5.3.1
  • pyyaml Debian 14, Debian 13, Debian 12 5.3-2

debian advisories DEBIAN-CVE-2020-1747

  • pytz RHEL 8 2019.3-3.module+el8.2.0+5234+f98739b6
  • babel RHEL 8 2.7.0-10.module+el8.2.0+5234+f98739b6
  • numpy RHEL 8 1.17.3-5.module+el8.3.0+7187+a27ec44b
  • scipy RHEL 8 1.3.1-4.module+el8.2.0+5234+f98739b6
  • Cython RHEL 8 0.29.14-4.module+el8.2.0+5234+f98739b6
  • PyYAML RHEL 8 5.3.1-1.module+el8.3.0+7187+a27ec44b
  • mod_wsgi RHEL 8 4.6.8-3.module+el8.2.0+5234+f98739b6
  • python38 RHEL 8 3.8.3-3.module+el8.3.0+7680+79e7e61a

red hat advisories RHSA-2020:4641

  • python-PyYAML SLES for SAP 15, SLES 15-LTSS, SLE Module for Public Cloud 15 +2 more 5.1.2-150000.3.6.1
  • python-PyYAML SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +19 more 5.1.2-26.12.1
  • python-PyYAML SLE Module for Python 2 15 SP1, SLE Module for Basesystem 15 SP1 5.1.2-6.6.1

suse advisories SUSE-SU-2022:2841-1SUSE-SU-2020:1285-1SUSE-SU-2020:0959-1

  • python-PyYAML openSUSE Leap 15.1 5.1.2-lp151.2.13.1
  • python-PyYAML openSUSE Leap 15.1 5.1.2-lp151.2.6.1

opensuse advisories openSUSE-SU-2020:0630-1openSUSE-SU-2020:0507-1

  • python38-py AlmaLinux 8 1.8.0-8.module_el8.4.0+2510+cb4d423d
  • python38-py AlmaLinux 8 1.8.0-8.module_el8.6.0+2778+cd494b30
  • python38-ply AlmaLinux 8 3.11-10.module_el8.6.0+2778+cd494b30
  • python38-six AlmaLinux 8 1.12.0-10.module_el8.6.0+2778+cd494b30
  • python38-cffi AlmaLinux 8 1.13.2-3.module_el8.6.0+2778+cd494b30
  • python38-idna AlmaLinux 8 2.8-6.module_el8.6.0+2778+cd494b30
  • python38-pytz AlmaLinux 8 2019.3-3.module_el8.6.0+2778+cd494b30
  • python38-attrs AlmaLinux 8 19.3.0-3.module_el8.6.0+2778+cd494b30

almalinux advisories ALSA-2021:2583ALSA-2020:4641

  • pytz Rocky Linux 8 2019.3-3.module+el8.4.0+570+c2eaf144
  • babel Rocky Linux 8 2.7.0-10.module+el8.4.0+570+c2eaf144
  • numpy Rocky Linux 8 1.17.3-5.module+el8.4.0+570+c2eaf144
  • scipy Rocky Linux 8 1.3.1-4.module+el8.5.0+672+ab6eb015
  • scipy Rocky Linux 8 1.3.1-4.module+el8.4.0+570+c2eaf144
  • Cython Rocky Linux 8 0.29.14-4.module+el8.4.0+570+c2eaf144
  • PyYAML Rocky Linux 8 5.3.1-1.module+el8.4.0+570+c2eaf144
  • mod_wsgi Rocky Linux 8 4.6.8-3.module+el8.4.0+570+c2eaf144

rocky linux advisories RLSA-2020:4641

  • py3-yaml Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 5.3.1-r0

alpine advisories ALPINE-CVE-2020-1747

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • PyYAML CBL-Mariner 2.0 5.4.1-1

azure linux advisories AZL-31783

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2020-1747 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1747 updated cvss 9.8

PyYAML: arbitrary command execution through python/object/new when FullLoader is used

  • Red Hat Quay 3 python-PyYAML
    affected: workaround, no fix planned “Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.”
  • Red Hat Software Collections rh-python38-python-pyyaml
    affected: workaround, no fix available “Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.”
  • Red Hat Enterprise Linux AppStream (v. 8) pytz 2019.3-3.module+el8.2.0+5234+f98739b6, scipy 1.3.1-4.module+el8.2.0+5234+f98739b6, babel 2.7.0-10.module+el8.2.0+5234+f98739b6, numpy 1.17.3-5.module+el8.3.0+7187+a27ec44b, PyYAML 5.3.1-1.module+el8.3.0+7187+a27ec44b, Cython 0.29.14-4.module+el8.2.0+5234+f98739b6, +59 more
    fixed: vendor fix “Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.” RHSA-2020:4641
  • Red Hat Enterprise Linux 6 PyYAML Red Hat Enterprise Linux 7 PyYAML Red Hat Enterprise Linux 8 PyYAML, python2-pyyaml, python38-pyyaml, python39-pyyaml Red Hat Enterprise Linux 9 python3-pyyaml Red Hat OpenStack Platform 10 (Newton) PyYAML Red Hat OpenStack Platform 13 (Queens) PyYAML
    +1 more products
    Red Hat Software Collections python27-PyYAML, rh-python36-PyYAML
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.44% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi pyyaml
>=5.1b7, <5.3.1
>=5.1, <5.3.1
5.3.1

Affected products

  • Red Hat PyYAML

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.