PT-2021-3478 · Pypi+9 · Pyyaml+9

Ahmed Shah + 1 · Published 2020-05-27 · Updated 2025-12-29 · CVE-2020-14343

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PyYAML versions prior to 5.4

Description A flaw in the PyYAML library allows for arbitrary code execution when processing untrusted YAML files through the full load method or with the FullLoader loader. This issue enables an attacker to execute arbitrary code on the system by exploiting the python/object/new constructor. The vulnerability is due to incomplete input validation when handling untrusted input, which can be exploited by a remote attacker using a specially crafted file.

Recommendations For versions prior to 5.4, consider avoiding the use of the full load method or the FullLoader loader when processing untrusted YAML files until a patch is available. As a temporary workaround, restrict the processing of untrusted input to minimize the risk of exploitation.

Exploit

Fix

Use After Free

RCE

Weakness Enumeration

CWE-416

CWE-20

Related Identifiers

ALSA-2021:2583

ALSA-2021_2583

ALT-PU-2021-1521

ALT-PU-2021-1534

AZL-31782

BDU:2021-03488

BDU:2023-05108

CESA-2021_2583

CVE-2020-14343

GHSA-8Q59-Q68H-6HV4

MGASA-2021-0119

OESA-2021-1257

OPENSUSE-SU-2024:11108-1

OPENSUSE-SU-2024:11210-1

OPENSUSE-SU-2024:14089-1

PYSEC-2021-142

RHSA-2021:2583

RHSA-2021:4702

RHSA-2021_2583

RLSA-2021:2583

SUSE-FU-2022:0444-1

SUSE-FU-2022:0445-1

SUSE-RU-2021:0985-1

SUSE-SU-2021:2818-1

SUSE-SU-2021_2818-1

SUSE-SU-2022:2841-1

SUSE-SU-2022:3231-1

SUSE-SU-2022_2841-1

SUSE-SU-2022_3231-1

USN-4940-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Pyyaml

Red Hat

Rocky Linux

Suse

Ubuntu

References · 95

• 🔥❌ https://github.com/raul23/pyyaml-CVE-2020-14343 · Exploit, Deleted
• https://linux.oracle.com/errata/ELSA-2021-2583.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14343 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE54 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-31782 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14343 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:2583 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-14343 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-2583.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:2583 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0119 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11210-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3231-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14343 · Vendor Advisory