Catalogo CVE

CVE-2020-1747

pyyaml: CVE-2020-1747

[Catalogo CVE]

Gravità
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.44% · Oct 22, 2026

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpyyamlsid6.0.3-1fixed
Debianpyyamlforky6.0.3-1fixed
Debianpyyamltrixie6.0.2-1fixed
Debianpyyamlbookworm6.0-3fixed
Alpinepy3-yaml3.115.3.1-r0fixed
Alpinepy3-yaml3.125.3.1-r0fixed
Alpinepy3-yaml3.135.3.1-r0fixed
Alpinepy3-yaml3.145.3.1-r0fixed
Alpinepy3-yaml3.155.3.1-r0fixed
Alpinepy3-yaml3.165.3.1-r0fixed
Alpinepy3-yaml3.175.3.1-r0fixed
Alpinepy3-yaml3.185.3.1-r0fixed
Alpinepy3-yaml3.195.3.1-r0fixed
Alpinepy3-yaml3.205.3.1-r0fixed
Alpinepy3-yaml3.215.3.1-r0fixed
Alpinepy3-yaml3.225.3.1-r0fixed
Alpinepy3-yaml3.235.3.1-r0fixed
Alpinepy3-yaml3.245.3.1-r0fixed
Susepython-PyYAMLhpe helion openstack 85.1.2-26.12.1fixed
Susepython-PyYAMLopenstack cloud 6-ltss5.1.2-26.12.1fixed
Susepython-PyYAMLopenstack cloud 75.1.2-26.12.1fixed
Susepython-PyYAMLopenstack cloud 85.1.2-26.12.1fixed
Susepython-PyYAMLopenstack cloud crowbar 85.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise high availability extension 12 sp15.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise high availability extension 12 sp25.1.2-26.12.1fixed
Susepython-PyYAMLmanager client tools 125.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise module for advanced systems management 125.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise module for containers 125.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise module for public cloud 125.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise point of sale 12 sp25.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise server for sap applications 12 sp35.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise server 12 sp3-ltss5.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise server 12 sp3-bcl5.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise server 12 sp45.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise server for sap applications 12 sp45.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise server 12 sp55.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise server for sap applications 12 sp55.1.2-26.12.1fixed
Susepython-PyYAMLmanager proxy 3.25.1.2-26.12.1fixed
Susepython-PyYAMLmanager server 3.25.1.2-26.12.1fixed
Susepython-PyYAMLenterprise storage 55.1.2-26.12.1fixed
Susepython-PyYAMLlinux enterprise module for basesystem 15 sp15.1.2-6.6.1fixed
Susepython-PyYAMLlinux enterprise module for python 2 15 sp15.1.2-6.6.1fixed
Opensusepython-PyYAMLleap 15.15.1.2-lp151.2.13.1fixed
Opensusepython-PyYAMLleap 15.15.1.2-lp151.2.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpyyamlsourcesid5.3-2not yet assignedNot reported[953013]
Debianpyyamlsourceforky5.3-2not yet assignedNot reported[953013]
Debianpyyamlsourcetrixie5.3-2not yet assignedNot reported[953013]
Debianpyyamlsourcebookworm5.3-2not yet assignedNot reported[953013]
Alpinepy3-yamlapk3.115.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.125.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.135.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.145.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.155.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.165.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.175.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.185.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.195.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.205.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.215.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.225.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.235.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Alpinepy3-yamlapk3.245.3.1-r0Not reportedALPINE-CVE-2020-1747Not reported
Susepython-PyYAMLrpmhpe helion openstack 85.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmopenstack cloud 6-ltss5.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmopenstack cloud 75.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmopenstack cloud 85.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmopenstack cloud crowbar 85.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise high availability extension 12 sp15.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise high availability extension 12 sp25.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmmanager client tools 125.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise module for advanced systems management 125.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise module for containers 125.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise module for public cloud 125.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise point of sale 12 sp25.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise server for sap applications 12 sp35.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise server 12 sp3-ltss5.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise server 12 sp3-bcl5.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise server 12 sp45.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise server for sap applications 12 sp45.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise server 12 sp55.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise server for sap applications 12 sp55.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmmanager proxy 3.25.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmmanager server 3.25.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmenterprise storage 55.1.2-26.12.1Not reportedSUSE-SU-2020:1285-1Not reported
Susepython-PyYAMLrpmlinux enterprise module for basesystem 15 sp15.1.2-6.6.1Not reportedSUSE-SU-2020:0959-1Not reported
Susepython-PyYAMLrpmlinux enterprise module for python 2 15 sp15.1.2-6.6.1Not reportedSUSE-SU-2020:0959-1Not reported
Opensusepython-PyYAMLrpmleap 15.15.1.2-lp151.2.13.1Not reportedOPENSUSE-SU-2020:0630-1Not reported
Opensusepython-PyYAMLrpmleap 15.15.1.2-lp151.2.6.1Not reportedOPENSUSE-SU-2020:0507-1Not reported

[Debian bug #953013]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-yaml]Corretta

    Pacchetto sorgente: [pyyaml]

    Dettagli (2)

    • 6.0-3+b2 · amd64 · bookworm

      Corretta · Corretta: 5.3-2

      dsa · pyyaml · debian · bookworm; dsa · pyyaml · debian · 12

    • 6.0-3+b2 · arm64 · bookworm

      Corretta · Corretta: 5.3-2

      dsa · pyyaml · debian · bookworm; dsa · pyyaml · debian · 12

[Debian 13 (Trixie)]

  • [python3-yaml]Corretta

    Pacchetto sorgente: [pyyaml]

    Dettagli (2)

    • 6.0.2-1+b2 · amd64 · trixie

      Corretta · Corretta: 5.3-2

      dsa · pyyaml · debian · 13

    • 6.0.2-1+b2 · arm64 · trixie

      Corretta · Corretta: 5.3-2

      dsa · pyyaml · debian · 13

Osservato:

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]