A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

The version of PyYAML installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-1747 advisory.

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4641 advisory.

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a     class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists     because of an incomplete fix for CVE-2017-18342. (CVE-2019-20477)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4641 advisory.

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a     class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists     because of an incomplete fix for CVE-2017-18342. (CVE-2019-20477)

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2841-1 advisory.

  - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. (CVE-2020-14343)

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4641 advisory.

  - PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

  - python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

  - python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

  - PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

  - python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-eed7193502 advisory.

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

  - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. (CVE-2020-14343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-3342569a0f advisory.

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

  - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. (CVE-2020-14343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4641 advisory.

  - PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

  - python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

  - PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

  - python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

  - python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the PyYAML package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - YAML is a data serialization format designed for human     readability and interaction with scripting languages.
    PyYAML is a YAML parser and emitter for Python. PyYAML     features a complete YAML 1.1 parser, Unicode support,     pickle support, capable extension API, and sensible     error messages. PyYAML supports standard YAML tags and     provides Python-specific tags that allow to represent     an arbitrary Python object. PyYAML is applicable for a     broad range of tasks from complex configuration files     to object serialization and persistance.Security     Fix(es):A vulnerability was discovered in the PyYAML     library in versions before 5.3.1, where it is     susceptible to arbitrary code execution when it     processes untrusted YAML files through the full_load     method or with the FullLoader loader. Applications that     use the library to process untrusted input may be     vulnerable to this flaw. An attacker could use this     flaw to execute arbitrary code on the system by abusing     the python/object/new constructor.(CVE-2020-1747)PyYAML     5.1 through 5.1.2 has insufficient restrictions on the     load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in the PyYAML library in     versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted     YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to     process untrusted input may be vulnerable to this flaw.
    An attacker could use this flaw to execute arbitrary     code on the system by abusing the python/object/new     constructor.(CVE-2020-1747)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A vulnerability was discovered in the PyYAML library in     versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted     YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to     process untrusted input may be vulnerable to this flaw.
    An attacker could use this flaw to execute arbitrary     code on the system by abusing the python/object/new     constructor.(CVE-2020-1747)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the PyYaml packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was discovered in the PyYAML library in     versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted     YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to     process untrusted input may be vulnerable to this flaw.
    An attacker could use this flaw to execute arbitrary     code on the system by abusing the python/object/new     constructor.(CVE-2020-1747)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-PyYAML fixes the following issues :

CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader (bsc#1165439).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-PyYAML fixes the following issues :

  - CVE-2020-1747: Fixed an arbitrary code execution when     YAML files are parsed by FullLoader (bsc#1165439).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

An update of the PyYAML package has been released.

Riccardo Schirone (https://github.com/ret2libc) reports :

In FullLoader python/object/new constructor, implemented by construct_python_object_apply, has support for setting the state of a deserialized instance through the set_python_instance_state method.
After setting the state, some operations are performed on the instance to complete its initialization, however it is possible for an attacker to set the instance' state in such a way that arbitrary code is executed by the FullLoader.

This patch tries to block such attacks in FullLoader by preventing set_python_instance_state from setting arbitrar properties. It implements a blacklist that includes extend method (called by construct_python_object_apply) and all special methods (e.g. __set__,
__setitem__, etc.).

Users who need special attributes being set in the state of a deserialized object can still do it through the UnsafeLoader, which however should not be used on untrusted input. Additionally, they can subclass FullLoader and redefine state_blacklist_regexp to include the additional attributes they need, passing the subclassed loader to yaml.load.

- New upstream release 5.3.1 (rhbz#1814882)

  - Fixes CVE-2020-1747 (rhbz#1807367,1809011)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
185501	CBL Mariner 2.0 Security Update: PyYAML (CVE-2020-1747)	Nessus	MarinerOS Local Security Checks	critical
184747	Rocky Linux 8 : python38:3.8 (RLSA-2020:4641)	Nessus	Rocky Linux Local Security Checks	critical
180934	Oracle Linux 8 : python38:3.8 (ELSA-2020-4641)	Nessus	Oracle Linux Local Security Checks	critical
164306	SUSE SLES15 Security Update : python-PyYAML (SUSE-SU-2022:2841-1)	Nessus	SuSE Local Security Checks	critical
146036	CentOS 8 : python38:3.8 (CESA-2020:4641)	Nessus	CentOS Local Security Checks	critical
145763	Fedora 32 : PyYAML (2021-eed7193502)	Nessus	Fedora Local Security Checks	critical
145367	Fedora 33 : PyYAML (2021-3342569a0f)	Nessus	Fedora Local Security Checks	critical
142431	RHEL 8 : python38:3.8 (RHSA-2020:4641)	Nessus	Red Hat Local Security Checks	critical
142093	EulerOS 2.0 SP5 : PyYAML (EulerOS-SA-2020-2269)	Nessus	Huawei Local Security Checks	critical
140318	EulerOS Virtualization for ARM 64 3.0.2.0 : PyYAML (EulerOS-SA-2020-1948)	Nessus	Huawei Local Security Checks	critical
140015	EulerOS Virtualization for ARM 64 3.0.6.0 : PyYAML (EulerOS-SA-2020-1912)	Nessus	Huawei Local Security Checks	critical
139155	EulerOS 2.0 SP8 : PyYaml (EulerOS-SA-2020-1825)	Nessus	Huawei Local Security Checks	critical
136784	SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2020:1285-1)	Nessus	SuSE Local Security Checks	critical
136456	openSUSE Security Update : python-PyYAML (openSUSE-2020-630)	Nessus	SuSE Local Security Checks	critical
136104	Photon OS 1.0: Pyyaml PHSA-2020-1.0-0290	Nessus	PhotonOS Local Security Checks	critical
136021	FreeBSD : py-yaml -- FullLoader (still) exploitable for arbitrary command execution (aae8fecf-888e-11ea-9714-08002718de91)	Nessus	FreeBSD Local Security Checks	critical
135866	Photon OS 2.0: Pyyaml PHSA-2020-2.0-0229	Nessus	PhotonOS Local Security Checks	critical
135789	Photon OS 3.0: Pyyaml PHSA-2020-3.0-0080	Nessus	PhotonOS Local Security Checks	critical
135451	openSUSE Security Update : python-PyYAML (openSUSE-2020-507)	Nessus	SuSE Local Security Checks	critical
135390	SUSE SLED15 / SLES15 Security Update : python-PyYAML (SUSE-SU-2020:0959-1)	Nessus	SuSE Local Security Checks	critical
134996	Fedora 31 : PyYAML (2020-bdb0bfa928)	Nessus	Fedora Local Security Checks	critical
134991	Fedora 30 : PyYAML (2020-40c35d7b37)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-1747

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical