CVE-2019-20477
Deserialization of Untrusted Data in PyYAML
9.8 CriticalFix available
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
5.11%Up 4.1 points since Apr 14, 2021
What each source reports
NVD Score used
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
CVE-2019-20477- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
CVE-2019-20477- Updated
- 2026-11-02
EUVDEUVD-2020-0159 No score
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
EUVD-2020-0159- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3pqx-4fqf-j49f
Deserialization of Untrusted Data in PyYAML
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
GHSA-3pqx-4fqf-j49f- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVBELL-CVE-2019-20477
CVE-2019-20477 does not affect BellSoft software
- Record
BELL-CVE-2019-20477- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
CVE-2019-20477- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2019-20477
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
DEBIAN-CVE-2019-20477- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3pqx-4fqf-j49f
Deserialization of Untrusted Data in PyYAML
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
GHSA-3pqx-4fqf-j49f- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVRHSA-2020:4641
Red Hat Security Advisory: python38:3.8 security, bug fix, and enhancement update
- Record
RHSA-2020:4641- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2020:4641
Moderate: python38:3.8 security, bug fix, and enhancement update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)
Security Fix(es):
-
PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)
-
python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)
-
PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)
-
python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)
-
python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
- Record
RLSA-2020:4641- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-20477
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
UBUNTU-CVE-2019-20477- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2020:4641 No score
Moderate: python38:3.8 security, bug fix, and enhancement update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)
Security Fix(es):
-
PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)
-
python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)
-
PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)
-
python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)
-
python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2020:4641- Updated
- 2026-11-02
OSVPYSEC-2020-176 No score
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
- Record
PYSEC-2020-176- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyyamlPyPI |
5.1 up to 5.2 | 5.2 |
python38-CythonAlmaLinux:8 From an advisory covering 5 CVEs |
before 0.29.14-4.module_el8.6.0+2778+cd494b30 | 0.29.14-4.module_el8.6.0+2778+cd494b30 |
python38-asn1cryptoAlmaLinux:8 From an advisory covering 5 CVEs |
before 1.2.0-3.module_el8.6.0+2778+cd494b30 | 1.2.0-3.module_el8.6.0+2778+cd494b30 |
python38-cffiAlmaLinux:8 From an advisory covering 5 CVEs |
before 1.13.2-3.module_el8.6.0+2778+cd494b30 | 1.13.2-3.module_el8.6.0+2778+cd494b30 |
python38-chardetAlmaLinux:8 From an advisory covering 5 CVEs |
before 3.0.4-19.module_el8.6.0+2778+cd494b30 | 3.0.4-19.module_el8.6.0+2778+cd494b30 |
python38-cryptographyAlmaLinux:8 From an advisory covering 5 CVEs |
before 2.8-3.module_el8.6.0+2778+cd494b30 | 2.8-3.module_el8.6.0+2778+cd494b30 |
python38-idnaAlmaLinux:8 From an advisory covering 5 CVEs |
before 2.8-6.module_el8.6.0+2778+cd494b30 | 2.8-6.module_el8.6.0+2778+cd494b30 |
python38-markupsafeAlmaLinux:8 From an advisory covering 5 CVEs |
before 1.1.1-6.module_el8.6.0+2778+cd494b30 | 1.1.1-6.module_el8.6.0+2778+cd494b30 |
python38-mod_wsgiAlmaLinux:8 From an advisory covering 5 CVEs |
before 4.6.8-3.module_el8.6.0+2778+cd494b30 | 4.6.8-3.module_el8.6.0+2778+cd494b30 |
python38-psycopg2AlmaLinux:8 From an advisory covering 5 CVEs |
before 2.8.4-4.module_el8.6.0+2778+cd494b30 | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
Show 129 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python38-psycopg2-docAlmaLinux:8 From an advisory covering 5 CVEs |
before 2.8.4-4.module_el8.6.0+2778+cd494b30 | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
python38-psycopg2-testsAlmaLinux:8 From an advisory covering 5 CVEs |
before 2.8.4-4.module_el8.6.0+2778+cd494b30 | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
python38-pycparserAlmaLinux:8 From an advisory covering 5 CVEs |
before 2.19-3.module_el8.6.0+2778+cd494b30 | 2.19-3.module_el8.6.0+2778+cd494b30 |
python38-pysocksAlmaLinux:8 From an advisory covering 5 CVEs |
before 1.7.1-4.module_el8.6.0+2778+cd494b30 | 1.7.1-4.module_el8.6.0+2778+cd494b30 |
python38-pytzAlmaLinux:8 From an advisory covering 5 CVEs |
before 2019.3-3.module_el8.6.0+2778+cd494b30 | 2019.3-3.module_el8.6.0+2778+cd494b30 |
python38-requestsAlmaLinux:8 From an advisory covering 5 CVEs |
before 2.22.0-9.module_el8.6.0+2778+cd494b30 | 2.22.0-9.module_el8.6.0+2778+cd494b30 |
python38-scipyAlmaLinux:8 From an advisory covering 5 CVEs |
before 1.3.1-4.module_el8.6.0+2778+cd494b30 | 1.3.1-4.module_el8.6.0+2778+cd494b30 |
pyyamlDebian:12 |
before 5.2-1 | 5.2-1 |
pyyamlDebian:13 |
before 5.2-1 | 5.2-1 |
pyyamlDebian:14 |
before 5.2-1 | 5.2-1 |
pyyamlPyPI |
5.1 up to 5.2, plus listed versions 5.1.15.1.25.2b1 |
5.2 |
pyyamlPyPI |
5.1 up to 5.2b1, plus listed versions 5.1.15.1.2 |
5.2b1 |
CythonRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.29.14-4.module+el8.2.0+5234+f98739b6 | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
Cython-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.29.14-4.module+el8.2.0+5234+f98739b6 | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
PyYAMLRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
PyYAML-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
babelRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.7.0-10.module+el8.2.0+5234+f98739b6 | 0:2.7.0-10.module+el8.2.0+5234+f98739b6 |
mod_wsgiRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:4.6.8-3.module+el8.2.0+5234+f98739b6 | 0:4.6.8-3.module+el8.2.0+5234+f98739b6 |
numpyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
numpy-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
python-PyMySQLRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.9.3-3.module+el8.2.0+5234+f98739b6 | 0:0.9.3-3.module+el8.2.0+5234+f98739b6 |
python-asn1cryptoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.2.0-3.module+el8.2.0+5234+f98739b6 | 0:1.2.0-3.module+el8.2.0+5234+f98739b6 |
python-cffiRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.13.2-3.module+el8.2.0+5234+f98739b6 | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
python-cffi-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.13.2-3.module+el8.2.0+5234+f98739b6 | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
python-chardetRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.0.4-19.module+el8.2.0+5234+f98739b6 | 0:3.0.4-19.module+el8.2.0+5234+f98739b6 |
python-cryptographyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8-3.module+el8.2.0+5234+f98739b6 | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
python-cryptography-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8-3.module+el8.2.0+5234+f98739b6 | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
python-idnaRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8-6.module+el8.2.0+5234+f98739b6 | 0:2.8-6.module+el8.2.0+5234+f98739b6 |
python-jinja2Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.10.3-4.module+el8.2.0+5234+f98739b6 | 0:2.10.3-4.module+el8.2.0+5234+f98739b6 |
python-lxmlRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:4.4.1-4.module+el8.2.0+5234+f98739b6 | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
python-lxml-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:4.4.1-4.module+el8.2.0+5234+f98739b6 | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
python-markupsafeRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.1.1-6.module+el8.2.0+5234+f98739b6 | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
python-markupsafe-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.1.1-6.module+el8.2.0+5234+f98739b6 | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
python-plyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.11-8.module+el8.2.0+5234+f98739b6 | 0:3.11-8.module+el8.2.0+5234+f98739b6 |
python-psutilRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.6.4-3.module+el8.2.0+5234+f98739b6 | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
python-psutil-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.6.4-3.module+el8.2.0+5234+f98739b6 | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
python-psycopg2Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.2.0+5234+f98739b6 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
python-psycopg2-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.2.0+5234+f98739b6 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
python-pycparserRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.19-3.module+el8.2.0+5234+f98739b6 | 0:2.19-3.module+el8.2.0+5234+f98739b6 |
python-pysocksRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.7.1-4.module+el8.2.0+5234+f98739b6 | 0:1.7.1-4.module+el8.2.0+5234+f98739b6 |
python-requestsRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.22.0-9.module+el8.2.0+5234+f98739b6 | 0:2.22.0-9.module+el8.2.0+5234+f98739b6 |
python-sixRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.12.0-9.module+el8.2.0+5234+f98739b6 | 0:1.12.0-9.module+el8.2.0+5234+f98739b6 |
python-urllib3Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.25.7-4.module+el8.2.0+5234+f98739b6 | 0:1.25.7-4.module+el8.2.0+5234+f98739b6 |
python-wheelRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.33.6-5.module+el8.3.0+7187+a27ec44b | 0:0.33.6-5.module+el8.3.0+7187+a27ec44b |
python38Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-CythonRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.29.14-4.module+el8.2.0+5234+f98739b6 | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
python38-Cython-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.29.14-4.module+el8.2.0+5234+f98739b6 | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
python38-PyMySQLRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.9.3-3.module+el8.2.0+5234+f98739b6 | 0:0.9.3-3.module+el8.2.0+5234+f98739b6 |
python38-asn1cryptoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.2.0-3.module+el8.2.0+5234+f98739b6 | 0:1.2.0-3.module+el8.2.0+5234+f98739b6 |
python38-babelRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.7.0-10.module+el8.2.0+5234+f98739b6 | 0:2.7.0-10.module+el8.2.0+5234+f98739b6 |
python38-cffiRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.13.2-3.module+el8.2.0+5234+f98739b6 | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
python38-cffi-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.13.2-3.module+el8.2.0+5234+f98739b6 | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
python38-chardetRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.0.4-19.module+el8.2.0+5234+f98739b6 | 0:3.0.4-19.module+el8.2.0+5234+f98739b6 |
python38-cryptographyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8-3.module+el8.2.0+5234+f98739b6 | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
python38-cryptography-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8-3.module+el8.2.0+5234+f98739b6 | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
python38-debugRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-develRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-idleRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-idnaRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8-6.module+el8.2.0+5234+f98739b6 | 0:2.8-6.module+el8.2.0+5234+f98739b6 |
python38-jinja2Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.10.3-4.module+el8.2.0+5234+f98739b6 | 0:2.10.3-4.module+el8.2.0+5234+f98739b6 |
python38-libsRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-lxmlRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:4.4.1-4.module+el8.2.0+5234+f98739b6 | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
python38-lxml-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:4.4.1-4.module+el8.2.0+5234+f98739b6 | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
python38-markupsafeRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.1.1-6.module+el8.2.0+5234+f98739b6 | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
python38-markupsafe-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.1.1-6.module+el8.2.0+5234+f98739b6 | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
python38-mod_wsgiRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:4.6.8-3.module+el8.2.0+5234+f98739b6 | 0:4.6.8-3.module+el8.2.0+5234+f98739b6 |
python38-numpyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
python38-numpy-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
python38-numpy-docRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
python38-numpy-f2pyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
python38-pipRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:19.3.1-1.module+el8.3.0+7187+a27ec44b | 0:19.3.1-1.module+el8.3.0+7187+a27ec44b |
python38-pip-wheelRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:19.3.1-1.module+el8.3.0+7187+a27ec44b | 0:19.3.1-1.module+el8.3.0+7187+a27ec44b |
python38-plyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.11-8.module+el8.2.0+5234+f98739b6 | 0:3.11-8.module+el8.2.0+5234+f98739b6 |
python38-psutilRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.6.4-3.module+el8.2.0+5234+f98739b6 | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
python38-psutil-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.6.4-3.module+el8.2.0+5234+f98739b6 | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
python38-psycopg2Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.2.0+5234+f98739b6 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
python38-psycopg2-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.2.0+5234+f98739b6 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
python38-psycopg2-docRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.2.0+5234+f98739b6 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
python38-psycopg2-testsRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.2.0+5234+f98739b6 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
python38-pycparserRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.19-3.module+el8.2.0+5234+f98739b6 | 0:2.19-3.module+el8.2.0+5234+f98739b6 |
python38-pysocksRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.7.1-4.module+el8.2.0+5234+f98739b6 | 0:1.7.1-4.module+el8.2.0+5234+f98739b6 |
python38-pytzRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2019.3-3.module+el8.2.0+5234+f98739b6 | 0:2019.3-3.module+el8.2.0+5234+f98739b6 |
python38-pyyamlRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
python38-pyyaml-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
python38-requestsRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2.22.0-9.module+el8.2.0+5234+f98739b6 | 0:2.22.0-9.module+el8.2.0+5234+f98739b6 |
python38-rpm-macrosRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-scipyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.3.1-4.module+el8.2.0+5234+f98739b6 | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
python38-scipy-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.3.1-4.module+el8.2.0+5234+f98739b6 | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
python38-setuptoolsRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:41.6.0-4.module+el8.3.0+7187+a27ec44b | 0:41.6.0-4.module+el8.3.0+7187+a27ec44b |
python38-setuptools-wheelRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:41.6.0-4.module+el8.3.0+7187+a27ec44b | 0:41.6.0-4.module+el8.3.0+7187+a27ec44b |
python38-sixRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.12.0-9.module+el8.2.0+5234+f98739b6 | 0:1.12.0-9.module+el8.2.0+5234+f98739b6 |
python38-testRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-tkinterRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
python38-urllib3Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.25.7-4.module+el8.2.0+5234+f98739b6 | 0:1.25.7-4.module+el8.2.0+5234+f98739b6 |
python38-wheelRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.33.6-5.module+el8.3.0+7187+a27ec44b | 0:0.33.6-5.module+el8.3.0+7187+a27ec44b |
python38-wheel-wheelRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:0.33.6-5.module+el8.3.0+7187+a27ec44b | 0:0.33.6-5.module+el8.3.0+7187+a27ec44b |
python3x-pipRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:19.3.1-1.module+el8.3.0+7187+a27ec44b | 0:19.3.1-1.module+el8.3.0+7187+a27ec44b |
python3x-setuptoolsRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:41.6.0-4.module+el8.3.0+7187+a27ec44b | 0:41.6.0-4.module+el8.3.0+7187+a27ec44b |
pytzRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:2019.3-3.module+el8.2.0+5234+f98739b6 | 0:2019.3-3.module+el8.2.0+5234+f98739b6 |
scipyRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.3.1-4.module+el8.2.0+5234+f98739b6 | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
scipy-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs |
before 0:1.3.1-4.module+el8.2.0+5234+f98739b6 | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
babelRocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.7.0-10.module+el8.4.0+570+c2eaf144 | 0:2.7.0-10.module+el8.4.0+570+c2eaf144 |
CythonRocky Linux:8 From an advisory covering 5 CVEs |
before 0:0.29.14-4.module+el8.4.0+570+c2eaf144 | 0:0.29.14-4.module+el8.4.0+570+c2eaf144 |
mod_wsgiRocky Linux:8 From an advisory covering 5 CVEs |
before 0:4.6.8-3.module+el8.4.0+570+c2eaf144 | 0:4.6.8-3.module+el8.4.0+570+c2eaf144 |
numpyRocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.17.3-5.module+el8.4.0+570+c2eaf144 | 0:1.17.3-5.module+el8.4.0+570+c2eaf144 |
python3x-pipRocky Linux:8 From an advisory covering 5 CVEs |
before 0:19.3.1-1.module+el8.4.0+570+c2eaf144 | 0:19.3.1-1.module+el8.4.0+570+c2eaf144 |
python3x-setuptoolsRocky Linux:8 From an advisory covering 5 CVEs |
before 0:41.6.0-4.module+el8.4.0+570+c2eaf144 | 0:41.6.0-4.module+el8.4.0+570+c2eaf144 |
python-asn1cryptoRocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.2.0-3.module+el8.4.0+570+c2eaf144 | 0:1.2.0-3.module+el8.4.0+570+c2eaf144 |
python-cffiRocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.13.2-3.module+el8.4.0+570+c2eaf144 | 0:1.13.2-3.module+el8.4.0+570+c2eaf144 |
python-chardetRocky Linux:8 From an advisory covering 5 CVEs |
before 0:3.0.4-19.module+el8.4.0+570+c2eaf144 | 0:3.0.4-19.module+el8.4.0+570+c2eaf144 |
python-cryptographyRocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.8-3.module+el8.5.0+672+ab6eb015 | 0:2.8-3.module+el8.5.0+672+ab6eb015 |
python-cryptographyRocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.8-3.module+el8.4.0+570+c2eaf144 | 0:2.8-3.module+el8.4.0+570+c2eaf144 |
python-idnaRocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.8-6.module+el8.4.0+570+c2eaf144 | 0:2.8-6.module+el8.4.0+570+c2eaf144 |
python-jinja2Rocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.10.3-4.module+el8.4.0+570+c2eaf144 | 0:2.10.3-4.module+el8.4.0+570+c2eaf144 |
python-markupsafeRocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.1.1-6.module+el8.4.0+570+c2eaf144 | 0:1.1.1-6.module+el8.4.0+570+c2eaf144 |
python-psutilRocky Linux:8 From an advisory covering 5 CVEs |
before 0:5.6.4-3.module+el8.4.0+570+c2eaf144 | 0:5.6.4-3.module+el8.4.0+570+c2eaf144 |
python-psycopg2Rocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.6.0+794+eba84017 | 0:2.8.4-4.module+el8.6.0+794+eba84017 |
python-psycopg2Rocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.8.4-4.module+el8.4.0+570+c2eaf144 | 0:2.8.4-4.module+el8.4.0+570+c2eaf144 |
python-pycparserRocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.19-3.module+el8.4.0+570+c2eaf144 | 0:2.19-3.module+el8.4.0+570+c2eaf144 |
python-pysocksRocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.7.1-4.module+el8.4.0+570+c2eaf144 | 0:1.7.1-4.module+el8.4.0+570+c2eaf144 |
python-requestsRocky Linux:8 From an advisory covering 5 CVEs |
before 0:2.22.0-9.module+el8.4.0+570+c2eaf144 | 0:2.22.0-9.module+el8.4.0+570+c2eaf144 |
python-urllib3Rocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.25.7-4.module+el8.4.0+570+c2eaf144 | 0:1.25.7-4.module+el8.4.0+570+c2eaf144 |
python-wheelRocky Linux:8 From an advisory covering 5 CVEs |
before 0:0.33.6-5.module+el8.4.0+570+c2eaf144 | 0:0.33.6-5.module+el8.4.0+570+c2eaf144 |
pytzRocky Linux:8 From an advisory covering 5 CVEs |
before 0:2019.3-3.module+el8.4.0+570+c2eaf144 | 0:2019.3-3.module+el8.4.0+570+c2eaf144 |
PyYAMLRocky Linux:8 From an advisory covering 5 CVEs |
before 0:5.3.1-1.module+el8.4.0+570+c2eaf144 | 0:5.3.1-1.module+el8.4.0+570+c2eaf144 |
scipyRocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.3.1-4.module+el8.5.0+672+ab6eb015 | 0:1.3.1-4.module+el8.5.0+672+ab6eb015 |
scipyRocky Linux:8 From an advisory covering 5 CVEs |
before 0:1.3.1-4.module+el8.4.0+570+c2eaf144 | 0:1.3.1-4.module+el8.4.0+570+c2eaf144 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-20477 is a critical vulnerability (CVSS 9.8) in Pyyaml, published February 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.11%, the 92nd percentile. Fixed in pyyaml 5.2.
References
github.com/yaml/pyyaml/blob/master/CHANGES
exploit-db.com/download/47655
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H
nvd.nist.gov/vuln/detail/CVE-2019-20477
Show 46 moreShow less
access.redhat.com/errata/RHSA-2020:4641
bugzilla.redhat.com/1806005
errata.almalinux.org/8/ALSA-2020-4641.html
vulners.com/cve/CVE-2019-20477
docs.bell-sw.com/security/cves/CVE-2019-20477
security-tracker.debian.org/tracker/CVE-2019-20477
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4641.json
cve.org/CVERecord?id=CVE-2019-20477
errata.rockylinux.org/RLSA-2020:4641
ubuntu.com/security/CVE-2019-20477