Critical severity · published Feb 9, 2021
CVE-2020-14343
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the…
9.8
CVSS
6%
EPSS
No
On KEV
Description
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Communications Cloud Native Core Network Function Cloud Native Environment · Oracle
1.10.0; 22.1.0 · source: NVD
PY
Pyyaml · Pyyaml
5.1 before 5.4 · source: NVD
Affected product
CC
Communications Cloud Native Core Network Function Cloud Native Environment
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14343
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1860466
github.com
https://github.com/SeldonIO/seldon-core/issues/2252
github.com
https://github.com/yaml/pyyaml/issues/420
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from Communications Cloud Native Core Network Function Cloud Native Environment
10.0
CVE-2022-22947
VMware Spring Cloud Gateway Code Injection Vulnerability
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2022-22963
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
9.8
CVE-2022-23219
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating…
9.8
CVE-2021-3177
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept…