PYSEC-2020-195 - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Po

Severity: info · Published 2020-02-19

Technologies: PyYAML (PyPI). Vendors: PyPI.

Executive brief

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Affected products

PyPI PyYAML

Related threats

PYSEC-2021-142 - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it pro
PYSEC-2020-96 - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it p
PYSEC-2020-176 - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Po
PyYAML insecure deserialization in yaml.load API