Published: 09/02/2021 Updated: 06/07/2023

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 892

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

A vulnerability exists in the PyYAML library in versions prior to 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an malicious user to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pyyaml pyyaml
oracle communications cloud native core network function cloud native environment 22.1.0
oracle communications cloud native core network function cloud native environment 1.10.0

Debian Bug report logs - #966233 pyyaml: CVE-2020-14343 Package: src:pyyaml; Maintainer for src:pyyaml is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 25 Jul 2020 07:36:01 UTC Severity: important Tags: security, upstream Fo ...

A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader Applications that use the library to process untrusted input may be vulnerable to this flaw This flaw allows an attacker to execute arbitrary co ...

A web application vulnerable to CVE-2020-14343 insecure deserialization leading to command execution in PyYAML package.

loader-CVE-2020-14343 A web application vulnerable to CVE-2020-14343 insecure deserialization leading to command execution in PyYAML package Writeup: githubcom/TebbaaX/CTFs/blob/main/HackerNewsBdarija-CTF-2022/loadder/Loadermd

fork tornado-swagger, remove python3 feature.

tornado-swagger PyPI Linux Windows tornado-swagger: Swagger API Documentation builder for tornado server Inspired byaiohttp-swaggerpackage (based on this package sources) Documentation githubcom/mrk-andreev/tornado-swagger/wiki Code githubcom/mrk-andreev/tornado-swagger Issues githubcom/mrk-andreev/tornado

Experimenting with the CVE-2020-14343 PyYAML vulnerability

pyyaml-CVE-2020-14343 Testing the CVE-2020-14343 vulnerability that affects the PyYAML library (version<54) "where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader" [BUG] The whole testing setup is contained within the test_yaml_vuln package which must be installed

Swagger API Documentation builder for tornado server.

tornado-swagger PyPI Linux Windows tornado-swagger: Swagger API Documentation builder for tornado server Inspired byaiohttp-swaggerpackage (based on this package sources) Documentation githubcom/mrk-andreev/tornado-swagger/wiki Code githubcom/mrk-andreev/tornado-swagger Issues githubcom/mrk-andreev/tornado

DevSecOps workflow description For purpose of this technical assignement we use DVPWA app DVPWA is an intentionally vulnerable application This repo is a clone of DVPWA and is used for devsecops workflow technical challenges For SAST and SCA analysis of the code, we use Horusec open-source tool In this case, we use only CLI, which is not integrated with web UI of Horusec T

CWE-20 https://bugzilla.redhat.com/show_bug.cgi?id=1860466 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://github.com/SeldonIO/seldon-core/issues/2252 https://github.com/yaml/pyyaml/issues/420 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966233 https://nvd.nist.gov https://github.com/j4k0m/loader-CVE-2020-14343 https://security.archlinux.org/CVE-2020-14343

CVE-2020-14343

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect