Is CVE-2019-20477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-20477 being exploited in the wild.

How severe is CVE-2019-20477?

Low severity, with a CVSS score of 3.1, published 19 February 2020.

Which products and versions are affected?

PyYAML (PyPI) ECOSYSTEM:introduced=5.1,fixed=5.2, ECOSYSTEM:introduced=5.1,fixed=5.2b1.

Is there a fix for CVE-2019-20477?

Yes. PyYAML (PyPI): upgrade to 5.2, 5.2b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-20477 attacked?

It is attacked over the network.

Am I affected by CVE-2019-20477?

Check whether you run PyYAML (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-20477: PyYAML unsafe deserialization in load and load_all

CVE-2019-20477 · Severity: low · CVSS 3.1 · Published 2020-02-19

PyYAML is a widely-used Python library for parsing YAML configuration files and data formats. Versions 5.1 to 5.1.2 allow attackers to execute arbitrary code by providing malicious YAML input to the load() or load_all() functions, due to unsafe deserialization of Python object classes like subprocess.Popen. An attacker with the ability to control YAML input can achieve complete system compromise.

Technologies: PyYAML (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2019-20477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-20477 being exploited in the wild.
How severe is CVE-2019-20477?: Low severity, with a CVSS score of 3.1, published 19 February 2020.
Which products and versions are affected?: PyYAML (PyPI) ECOSYSTEM:introduced=5.1,fixed=5.2, ECOSYSTEM:introduced=5.1,fixed=5.2b1.
Is there a fix for CVE-2019-20477?: Yes. PyYAML (PyPI): upgrade to 5.2, 5.2b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-20477 attacked?: It is attacked over the network.
Am I affected by CVE-2019-20477?: Check whether you run PyYAML (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

PyYAML (PyPI): upgrade to 5.2, 5.2b1 or later
```
pip install "PyYAML>=5.2b1"
```

Technical details

PyYAML versions 5.1 through 5.1.2 suffer from unsafe deserialization of untrusted data (CWE-502). The vulnerability exists in the load() and load_all() functions which fail to properly restrict instantiation of arbitrary Python classes during YAML parsing. An attacker can craft a malicious YAML document that deserializes to dangerous classes such as subprocess.Popen, allowing arbitrary command execution. The flaw represents an incomplete fix for the earlier CVE-2017-18342. No authentication or user interaction is required; exploitation occurs whenever an application processes untrusted YAML input via load() or load_all(). This vulnerability was patched in version 5.2.

Affected products

PyYAML PyYAML 5.1 through 5.1.2

Identifiers

CVE-2019-20477
GHSA-3pqx-4fqf-j49f
PYSEC-2020-176

Timeline

2020-02-19: disclosed
2020: patched: Version 5.2 released

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.