CVE-2020-1747

highPriorität · verfolgen · 41EPSS 0.054 · 93. PerzentilEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

5.44% (93rd) EPSS

CVSS 10 · high

Is it mine?

19 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 9.3–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · secalert@redhat.com USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USCWE-20USCWE-20US

betroffene Produkte (19)

Betroffene Produkte und Versionsbereiche.

Red Hat PyYAML≤ 5.3.1enisa_euvdEU
Fedora Project Fedora≤ 31fstec_bduRU
Fedora Project Fedora≤ 30fstec_bduRU
Fedora Project Fedora≤ 32fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.1fstec_bduRU
АО «ИВК» Альт 8 СПalle Versionenfstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.12fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
Сообщество свободного программного обеспечения PyYAML≤ 5.3.1fstec_bduRU
fedoraproject fedora= 30nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 31nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 32nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 33nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
opensuse leap= 15.1nvdUScpe:2.3:o:opensuse:leap:*:*:*:*:*:*:*:*
oracle communications cloud native core network function cloud native environment= 22.1.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:*:*:*:*:*:*:*:*
pyyaml pyyaml5.1 → 5.3.1nvdUScpe:2.3:a:pyyaml:pyyaml:*:*:*:*:*:*:*:*
PyPI pyyaml5.1 → 5.3.1osvUSpkg:pypi/pyyaml
PyPI pyyaml5.1b7 → 5.3.1osvUSpkg:pypi/pyyaml

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-6757-jp84-gxfxImproper Input Validation in PyYAML2021-04-20ghsa · osvUS
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
PYSEC-2020-962020-03-24vendor · osvUS
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv nvd NVD CVE.org MITRE

veröffentlicht 2020-03-24geändert 2026-06-17

Referenzen (44)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan