- New upstream release 5.3.1 (rhbz#1814882)

  - Fixes CVE-2020-1747 (rhbz#1807367,1809011)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-PyYAML fixes the following issues :

  - CVE-2020-1747: Fixed an arbitrary code execution when     YAML files are parsed by FullLoader (bsc#1165439).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

According to the version of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A vulnerability was discovered in the PyYAML library in     versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted     YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to     process untrusted input may be vulnerable to this flaw.
    An attacker could use this flaw to execute arbitrary     code on the system by abusing the python/object/new     constructor.(CVE-2020-1747)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4641 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)

    Security Fix(es):

    * PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

    * python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

    * PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

    * python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

    * python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-3342569a0f advisory.

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

  - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. (CVE-2020-14343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0269 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2017-18342:
    In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The     load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward     compatibility with the function.

    CVE-2020-14343:
    A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

    CVE-2020-1747:
    A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
134991	Fedora 30 : PyYAML (2020-40c35d7b37)	Nessus	Fedora Local Security Checks	2020/3/30	2024/3/20	critical
135451	openSUSE Security Update : python-PyYAML (openSUSE-2020-507)	Nessus	SuSE Local Security Checks	2020/4/14	2024/3/19	critical
140015	EulerOS Virtualization for ARM 64 3.0.6.0 : PyYAML (EulerOS-SA-2020-1912)	Nessus	Huawei Local Security Checks	2020/8/28	2024/2/22	critical
142431	RHEL 8 : python38:3.8 (RHSA-2020:4641)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	critical
145367	Fedora 33 : PyYAML (2021-3342569a0f)	Nessus	Fedora Local Security Checks	2021/1/25	2025/12/2	critical
235945	Alibaba Cloud Linux 3 : 0269: PyYAML (ALINUX3-SA-2024:0269)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical