Improper input validation in Red Hat PyYAML
Priority MEDIUM 50CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Why it matters now
EPSS 0.05442 92nd percentileScored 2026-11-07
Fix Partial pyyaml (PyPI): 5.3.1Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | PyYAML | 5.3.1 | — | No fix listed | CNA |
| — | pyyaml (PyPI) | 5.1b7 to before 5.3.1 | 5.3.1 | Patch available | GHSA-6757-jp84-gxfx |
- PyYAML VendorRed Hat Affected 5.3.1 Fixed in — No fix listed CNA
- pyyaml (PyPI) Vendor— Affected 5.1b7 to before 5.3.1 Fixed in 5.3.1 Patch available GHSA-6757-jp84-gxfx
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pyyaml:pyyaml:*:*:*:*:*:*:*:* | 5.1 to before 5.3.1 | Vulnerable | Pyyaml |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* | 22.1.0 | Vulnerable | Oracle |
- cpe:2.3:a:pyyaml:pyyaml:*:*:*:*:*:*:*:* Versions 5.1 to before 5.3.1 Vulnerable ·Pyyaml
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-6757-jp84-gxfx pyyaml (PyPI) Fixed in 5.3.1 Advisory →
Red Hat 1 advisory
- RHSA-2020:4641 Released 2020-11-04 · Red Hat rating Moderatepython38:3.8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.2.0+5234+f98739b6.src::python38:3.8, PyYAML-5.3.1-1.module+el8.3.0+7187+a27ec44b.src::python38:3.8, babel-2.7.0-10.module+el8.2.0+5234+f98739b6.src::python38:3.8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4641 |
Not affected: 7 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1747
- 2026-10-03 Alias added: GHSA-6757-jp84-gxfx
References
Patch 3
Advisory 9
Other 10
- https://github.com/github/advisory-database/pull/4942
- https://github.com/yaml/pyyaml/commit/0cedb2a0697b2bc49e4f3841b8d4590b6b15657e
- https://github.com/yaml/pyyaml/commit/5080ba513377b6355a0502104846ee804656f1e0
- https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-96.yaml
- https://github.com/yaml/pyyaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX
- https://lists.fedoraproject.org/archives/list/[email protected]/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-1747 · CVE Program
- CVE-2020-1747 · NVD
- FIRST EPSS
- GHSA-6757-jp84-gxfx · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1747 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences