Every CVE Search/ Get API key

CVE-2019-20477

Deserialization of Untrusted Data in PyYAML

9.8 CriticalFix available

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.11%Up 4.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
CVE-2019-20477
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-502
Updated
2026-11-02
CVE List No score

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
CVE-2019-20477
Updated
2026-11-02
EUVDEUVD-2020-0159 No score

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
EUVD-2020-0159
Updated
2026-11-03
GitHub AdvisoriesGHSA-3pqx-4fqf-j49f 9.3

Deserialization of Untrusted Data in PyYAML

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
GHSA-3pqx-4fqf-j49f
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVBELL-CVE-2019-20477 9.8

CVE-2019-20477 does not affect BellSoft software

Record
BELL-CVE-2019-20477
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
CVE-2019-20477
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2019-20477 9.8

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
DEBIAN-CVE-2019-20477
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-3pqx-4fqf-j49f 9.3

Deserialization of Untrusted Data in PyYAML

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
GHSA-3pqx-4fqf-j49f
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVRHSA-2020:4641 9.8

Red Hat Security Advisory: python38:3.8 security, bug fix, and enhancement update

Record
RHSA-2020:4641
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2020:4641 9.8

Moderate: python38:3.8 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)

Security Fix(es):

  • PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

  • python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

  • PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

  • python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

  • python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Record
RLSA-2020:4641
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-20477 9.8

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
UBUNTU-CVE-2019-20477
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:4641 No score

Moderate: python38:3.8 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)

Security Fix(es):

  • PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

  • python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

  • PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

  • python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

  • python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:4641
Updated
2026-11-02
OSVPYSEC-2020-176 No score

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Record
PYSEC-2020-176
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pyyaml
PyPI
 5.1 up to 5.2
5.2
python38-Cython
AlmaLinux:8
 before 0.29.14-4.module_el8.6.0+2778+cd494b30
0.29.14-4.module_el8.6.0+2778+cd494b30
python38-asn1crypto
AlmaLinux:8
 before 1.2.0-3.module_el8.6.0+2778+cd494b30
1.2.0-3.module_el8.6.0+2778+cd494b30
python38-cffi
AlmaLinux:8
 before 1.13.2-3.module_el8.6.0+2778+cd494b30
1.13.2-3.module_el8.6.0+2778+cd494b30
python38-chardet
AlmaLinux:8
 before 3.0.4-19.module_el8.6.0+2778+cd494b30
3.0.4-19.module_el8.6.0+2778+cd494b30
python38-cryptography
AlmaLinux:8
 before 2.8-3.module_el8.6.0+2778+cd494b30
2.8-3.module_el8.6.0+2778+cd494b30
python38-idna
AlmaLinux:8
 before 2.8-6.module_el8.6.0+2778+cd494b30
2.8-6.module_el8.6.0+2778+cd494b30
python38-markupsafe
AlmaLinux:8
 before 1.1.1-6.module_el8.6.0+2778+cd494b30
1.1.1-6.module_el8.6.0+2778+cd494b30
python38-mod_wsgi
AlmaLinux:8
 before 4.6.8-3.module_el8.6.0+2778+cd494b30
4.6.8-3.module_el8.6.0+2778+cd494b30
python38-psycopg2
AlmaLinux:8
 before 2.8.4-4.module_el8.6.0+2778+cd494b30
2.8.4-4.module_el8.6.0+2778+cd494b30
Show 129 moreShow less
Affected packages
PackageAffectedFixed
python38-psycopg2-doc
AlmaLinux:8
 before 2.8.4-4.module_el8.6.0+2778+cd494b30
2.8.4-4.module_el8.6.0+2778+cd494b30
python38-psycopg2-tests
AlmaLinux:8
 before 2.8.4-4.module_el8.6.0+2778+cd494b30
2.8.4-4.module_el8.6.0+2778+cd494b30
python38-pycparser
AlmaLinux:8
 before 2.19-3.module_el8.6.0+2778+cd494b30
2.19-3.module_el8.6.0+2778+cd494b30
python38-pysocks
AlmaLinux:8
 before 1.7.1-4.module_el8.6.0+2778+cd494b30
1.7.1-4.module_el8.6.0+2778+cd494b30
python38-pytz
AlmaLinux:8
 before 2019.3-3.module_el8.6.0+2778+cd494b30
2019.3-3.module_el8.6.0+2778+cd494b30
python38-requests
AlmaLinux:8
 before 2.22.0-9.module_el8.6.0+2778+cd494b30
2.22.0-9.module_el8.6.0+2778+cd494b30
python38-scipy
AlmaLinux:8
 before 1.3.1-4.module_el8.6.0+2778+cd494b30
1.3.1-4.module_el8.6.0+2778+cd494b30
pyyaml
Debian:12
 before 5.2-1
5.2-1
pyyaml
Debian:13
 before 5.2-1
5.2-1
pyyaml
Debian:14
 before 5.2-1
5.2-1
pyyaml
PyPI
 5.1 up to 5.2, plus listed versions
5.1.15.1.25.2b1
5.2
pyyaml
PyPI
 5.1 up to 5.2b1, plus listed versions
5.1.15.1.2
5.2b1
Cython
Red Hat:enterprise_linux:8::appstream
 before 0:0.29.14-4.module+el8.2.0+5234+f98739b6
0:0.29.14-4.module+el8.2.0+5234+f98739b6
Cython-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.29.14-4.module+el8.2.0+5234+f98739b6
0:0.29.14-4.module+el8.2.0+5234+f98739b6
PyYAML
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b
0:5.3.1-1.module+el8.3.0+7187+a27ec44b
PyYAML-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b
0:5.3.1-1.module+el8.3.0+7187+a27ec44b
babel
Red Hat:enterprise_linux:8::appstream
 before 0:2.7.0-10.module+el8.2.0+5234+f98739b6
0:2.7.0-10.module+el8.2.0+5234+f98739b6
mod_wsgi
Red Hat:enterprise_linux:8::appstream
 before 0:4.6.8-3.module+el8.2.0+5234+f98739b6
0:4.6.8-3.module+el8.2.0+5234+f98739b6
numpy
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b
0:1.17.3-5.module+el8.3.0+7187+a27ec44b
numpy-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b
0:1.17.3-5.module+el8.3.0+7187+a27ec44b
python-PyMySQL
Red Hat:enterprise_linux:8::appstream
 before 0:0.9.3-3.module+el8.2.0+5234+f98739b6
0:0.9.3-3.module+el8.2.0+5234+f98739b6
python-asn1crypto
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.0-3.module+el8.2.0+5234+f98739b6
0:1.2.0-3.module+el8.2.0+5234+f98739b6
python-cffi
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.2-3.module+el8.2.0+5234+f98739b6
0:1.13.2-3.module+el8.2.0+5234+f98739b6
python-cffi-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.2-3.module+el8.2.0+5234+f98739b6
0:1.13.2-3.module+el8.2.0+5234+f98739b6
python-chardet
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.4-19.module+el8.2.0+5234+f98739b6
0:3.0.4-19.module+el8.2.0+5234+f98739b6
python-cryptography
Red Hat:enterprise_linux:8::appstream
 before 0:2.8-3.module+el8.2.0+5234+f98739b6
0:2.8-3.module+el8.2.0+5234+f98739b6
python-cryptography-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.8-3.module+el8.2.0+5234+f98739b6
0:2.8-3.module+el8.2.0+5234+f98739b6
python-idna
Red Hat:enterprise_linux:8::appstream
 before 0:2.8-6.module+el8.2.0+5234+f98739b6
0:2.8-6.module+el8.2.0+5234+f98739b6
python-jinja2
Red Hat:enterprise_linux:8::appstream
 before 0:2.10.3-4.module+el8.2.0+5234+f98739b6
0:2.10.3-4.module+el8.2.0+5234+f98739b6
python-lxml
Red Hat:enterprise_linux:8::appstream
 before 0:4.4.1-4.module+el8.2.0+5234+f98739b6
0:4.4.1-4.module+el8.2.0+5234+f98739b6
python-lxml-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:4.4.1-4.module+el8.2.0+5234+f98739b6
0:4.4.1-4.module+el8.2.0+5234+f98739b6
python-markupsafe
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.1-6.module+el8.2.0+5234+f98739b6
0:1.1.1-6.module+el8.2.0+5234+f98739b6
python-markupsafe-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.1-6.module+el8.2.0+5234+f98739b6
0:1.1.1-6.module+el8.2.0+5234+f98739b6
python-ply
Red Hat:enterprise_linux:8::appstream
 before 0:3.11-8.module+el8.2.0+5234+f98739b6
0:3.11-8.module+el8.2.0+5234+f98739b6
python-psutil
Red Hat:enterprise_linux:8::appstream
 before 0:5.6.4-3.module+el8.2.0+5234+f98739b6
0:5.6.4-3.module+el8.2.0+5234+f98739b6
python-psutil-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:5.6.4-3.module+el8.2.0+5234+f98739b6
0:5.6.4-3.module+el8.2.0+5234+f98739b6
python-psycopg2
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.4-4.module+el8.2.0+5234+f98739b6
0:2.8.4-4.module+el8.2.0+5234+f98739b6
python-psycopg2-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.4-4.module+el8.2.0+5234+f98739b6
0:2.8.4-4.module+el8.2.0+5234+f98739b6
python-pycparser
Red Hat:enterprise_linux:8::appstream
 before 0:2.19-3.module+el8.2.0+5234+f98739b6
0:2.19-3.module+el8.2.0+5234+f98739b6
python-pysocks
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.1-4.module+el8.2.0+5234+f98739b6
0:1.7.1-4.module+el8.2.0+5234+f98739b6
python-requests
Red Hat:enterprise_linux:8::appstream
 before 0:2.22.0-9.module+el8.2.0+5234+f98739b6
0:2.22.0-9.module+el8.2.0+5234+f98739b6
python-six
Red Hat:enterprise_linux:8::appstream
 before 0:1.12.0-9.module+el8.2.0+5234+f98739b6
0:1.12.0-9.module+el8.2.0+5234+f98739b6
python-urllib3
Red Hat:enterprise_linux:8::appstream
 before 0:1.25.7-4.module+el8.2.0+5234+f98739b6
0:1.25.7-4.module+el8.2.0+5234+f98739b6
python-wheel
Red Hat:enterprise_linux:8::appstream
 before 0:0.33.6-5.module+el8.3.0+7187+a27ec44b
0:0.33.6-5.module+el8.3.0+7187+a27ec44b
python38
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-Cython
Red Hat:enterprise_linux:8::appstream
 before 0:0.29.14-4.module+el8.2.0+5234+f98739b6
0:0.29.14-4.module+el8.2.0+5234+f98739b6
python38-Cython-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.29.14-4.module+el8.2.0+5234+f98739b6
0:0.29.14-4.module+el8.2.0+5234+f98739b6
python38-PyMySQL
Red Hat:enterprise_linux:8::appstream
 before 0:0.9.3-3.module+el8.2.0+5234+f98739b6
0:0.9.3-3.module+el8.2.0+5234+f98739b6
python38-asn1crypto
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.0-3.module+el8.2.0+5234+f98739b6
0:1.2.0-3.module+el8.2.0+5234+f98739b6
python38-babel
Red Hat:enterprise_linux:8::appstream
 before 0:2.7.0-10.module+el8.2.0+5234+f98739b6
0:2.7.0-10.module+el8.2.0+5234+f98739b6
python38-cffi
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.2-3.module+el8.2.0+5234+f98739b6
0:1.13.2-3.module+el8.2.0+5234+f98739b6
python38-cffi-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.13.2-3.module+el8.2.0+5234+f98739b6
0:1.13.2-3.module+el8.2.0+5234+f98739b6
python38-chardet
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.4-19.module+el8.2.0+5234+f98739b6
0:3.0.4-19.module+el8.2.0+5234+f98739b6
python38-cryptography
Red Hat:enterprise_linux:8::appstream
 before 0:2.8-3.module+el8.2.0+5234+f98739b6
0:2.8-3.module+el8.2.0+5234+f98739b6
python38-cryptography-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.8-3.module+el8.2.0+5234+f98739b6
0:2.8-3.module+el8.2.0+5234+f98739b6
python38-debug
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-idle
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-idna
Red Hat:enterprise_linux:8::appstream
 before 0:2.8-6.module+el8.2.0+5234+f98739b6
0:2.8-6.module+el8.2.0+5234+f98739b6
python38-jinja2
Red Hat:enterprise_linux:8::appstream
 before 0:2.10.3-4.module+el8.2.0+5234+f98739b6
0:2.10.3-4.module+el8.2.0+5234+f98739b6
python38-libs
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-lxml
Red Hat:enterprise_linux:8::appstream
 before 0:4.4.1-4.module+el8.2.0+5234+f98739b6
0:4.4.1-4.module+el8.2.0+5234+f98739b6
python38-lxml-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:4.4.1-4.module+el8.2.0+5234+f98739b6
0:4.4.1-4.module+el8.2.0+5234+f98739b6
python38-markupsafe
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.1-6.module+el8.2.0+5234+f98739b6
0:1.1.1-6.module+el8.2.0+5234+f98739b6
python38-markupsafe-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.1.1-6.module+el8.2.0+5234+f98739b6
0:1.1.1-6.module+el8.2.0+5234+f98739b6
python38-mod_wsgi
Red Hat:enterprise_linux:8::appstream
 before 0:4.6.8-3.module+el8.2.0+5234+f98739b6
0:4.6.8-3.module+el8.2.0+5234+f98739b6
python38-numpy
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b
0:1.17.3-5.module+el8.3.0+7187+a27ec44b
python38-numpy-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b
0:1.17.3-5.module+el8.3.0+7187+a27ec44b
python38-numpy-doc
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b
0:1.17.3-5.module+el8.3.0+7187+a27ec44b
python38-numpy-f2py
Red Hat:enterprise_linux:8::appstream
 before 0:1.17.3-5.module+el8.3.0+7187+a27ec44b
0:1.17.3-5.module+el8.3.0+7187+a27ec44b
python38-pip
Red Hat:enterprise_linux:8::appstream
 before 0:19.3.1-1.module+el8.3.0+7187+a27ec44b
0:19.3.1-1.module+el8.3.0+7187+a27ec44b
python38-pip-wheel
Red Hat:enterprise_linux:8::appstream
 before 0:19.3.1-1.module+el8.3.0+7187+a27ec44b
0:19.3.1-1.module+el8.3.0+7187+a27ec44b
python38-ply
Red Hat:enterprise_linux:8::appstream
 before 0:3.11-8.module+el8.2.0+5234+f98739b6
0:3.11-8.module+el8.2.0+5234+f98739b6
python38-psutil
Red Hat:enterprise_linux:8::appstream
 before 0:5.6.4-3.module+el8.2.0+5234+f98739b6
0:5.6.4-3.module+el8.2.0+5234+f98739b6
python38-psutil-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.6.4-3.module+el8.2.0+5234+f98739b6
0:5.6.4-3.module+el8.2.0+5234+f98739b6
python38-psycopg2
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.4-4.module+el8.2.0+5234+f98739b6
0:2.8.4-4.module+el8.2.0+5234+f98739b6
python38-psycopg2-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.4-4.module+el8.2.0+5234+f98739b6
0:2.8.4-4.module+el8.2.0+5234+f98739b6
python38-psycopg2-doc
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.4-4.module+el8.2.0+5234+f98739b6
0:2.8.4-4.module+el8.2.0+5234+f98739b6
python38-psycopg2-tests
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.4-4.module+el8.2.0+5234+f98739b6
0:2.8.4-4.module+el8.2.0+5234+f98739b6
python38-pycparser
Red Hat:enterprise_linux:8::appstream
 before 0:2.19-3.module+el8.2.0+5234+f98739b6
0:2.19-3.module+el8.2.0+5234+f98739b6
python38-pysocks
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.1-4.module+el8.2.0+5234+f98739b6
0:1.7.1-4.module+el8.2.0+5234+f98739b6
python38-pytz
Red Hat:enterprise_linux:8::appstream
 before 0:2019.3-3.module+el8.2.0+5234+f98739b6
0:2019.3-3.module+el8.2.0+5234+f98739b6
python38-pyyaml
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b
0:5.3.1-1.module+el8.3.0+7187+a27ec44b
python38-pyyaml-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.1-1.module+el8.3.0+7187+a27ec44b
0:5.3.1-1.module+el8.3.0+7187+a27ec44b
python38-requests
Red Hat:enterprise_linux:8::appstream
 before 0:2.22.0-9.module+el8.2.0+5234+f98739b6
0:2.22.0-9.module+el8.2.0+5234+f98739b6
python38-rpm-macros
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-scipy
Red Hat:enterprise_linux:8::appstream
 before 0:1.3.1-4.module+el8.2.0+5234+f98739b6
0:1.3.1-4.module+el8.2.0+5234+f98739b6
python38-scipy-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.3.1-4.module+el8.2.0+5234+f98739b6
0:1.3.1-4.module+el8.2.0+5234+f98739b6
python38-setuptools
Red Hat:enterprise_linux:8::appstream
 before 0:41.6.0-4.module+el8.3.0+7187+a27ec44b
0:41.6.0-4.module+el8.3.0+7187+a27ec44b
python38-setuptools-wheel
Red Hat:enterprise_linux:8::appstream
 before 0:41.6.0-4.module+el8.3.0+7187+a27ec44b
0:41.6.0-4.module+el8.3.0+7187+a27ec44b
python38-six
Red Hat:enterprise_linux:8::appstream
 before 0:1.12.0-9.module+el8.2.0+5234+f98739b6
0:1.12.0-9.module+el8.2.0+5234+f98739b6
python38-test
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-tkinter
Red Hat:enterprise_linux:8::appstream
 before 0:3.8.3-3.module+el8.3.0+7680+79e7e61a
0:3.8.3-3.module+el8.3.0+7680+79e7e61a
python38-urllib3
Red Hat:enterprise_linux:8::appstream
 before 0:1.25.7-4.module+el8.2.0+5234+f98739b6
0:1.25.7-4.module+el8.2.0+5234+f98739b6
python38-wheel
Red Hat:enterprise_linux:8::appstream
 before 0:0.33.6-5.module+el8.3.0+7187+a27ec44b
0:0.33.6-5.module+el8.3.0+7187+a27ec44b
python38-wheel-wheel
Red Hat:enterprise_linux:8::appstream
 before 0:0.33.6-5.module+el8.3.0+7187+a27ec44b
0:0.33.6-5.module+el8.3.0+7187+a27ec44b
python3x-pip
Red Hat:enterprise_linux:8::appstream
 before 0:19.3.1-1.module+el8.3.0+7187+a27ec44b
0:19.3.1-1.module+el8.3.0+7187+a27ec44b
python3x-setuptools
Red Hat:enterprise_linux:8::appstream
 before 0:41.6.0-4.module+el8.3.0+7187+a27ec44b
0:41.6.0-4.module+el8.3.0+7187+a27ec44b
pytz
Red Hat:enterprise_linux:8::appstream
 before 0:2019.3-3.module+el8.2.0+5234+f98739b6
0:2019.3-3.module+el8.2.0+5234+f98739b6
scipy
Red Hat:enterprise_linux:8::appstream
 before 0:1.3.1-4.module+el8.2.0+5234+f98739b6
0:1.3.1-4.module+el8.2.0+5234+f98739b6
scipy-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.3.1-4.module+el8.2.0+5234+f98739b6
0:1.3.1-4.module+el8.2.0+5234+f98739b6
babel
Rocky Linux:8
 before 0:2.7.0-10.module+el8.4.0+570+c2eaf144
0:2.7.0-10.module+el8.4.0+570+c2eaf144
Cython
Rocky Linux:8
 before 0:0.29.14-4.module+el8.4.0+570+c2eaf144
0:0.29.14-4.module+el8.4.0+570+c2eaf144
mod_wsgi
Rocky Linux:8
 before 0:4.6.8-3.module+el8.4.0+570+c2eaf144
0:4.6.8-3.module+el8.4.0+570+c2eaf144
numpy
Rocky Linux:8
 before 0:1.17.3-5.module+el8.4.0+570+c2eaf144
0:1.17.3-5.module+el8.4.0+570+c2eaf144
python3x-pip
Rocky Linux:8
 before 0:19.3.1-1.module+el8.4.0+570+c2eaf144
0:19.3.1-1.module+el8.4.0+570+c2eaf144
python3x-setuptools
Rocky Linux:8
 before 0:41.6.0-4.module+el8.4.0+570+c2eaf144
0:41.6.0-4.module+el8.4.0+570+c2eaf144
python-asn1crypto
Rocky Linux:8
 before 0:1.2.0-3.module+el8.4.0+570+c2eaf144
0:1.2.0-3.module+el8.4.0+570+c2eaf144
python-cffi
Rocky Linux:8
 before 0:1.13.2-3.module+el8.4.0+570+c2eaf144
0:1.13.2-3.module+el8.4.0+570+c2eaf144
python-chardet
Rocky Linux:8
 before 0:3.0.4-19.module+el8.4.0+570+c2eaf144
0:3.0.4-19.module+el8.4.0+570+c2eaf144
python-cryptography
Rocky Linux:8
 before 0:2.8-3.module+el8.5.0+672+ab6eb015
0:2.8-3.module+el8.5.0+672+ab6eb015
python-cryptography
Rocky Linux:8
 before 0:2.8-3.module+el8.4.0+570+c2eaf144
0:2.8-3.module+el8.4.0+570+c2eaf144
python-idna
Rocky Linux:8
 before 0:2.8-6.module+el8.4.0+570+c2eaf144
0:2.8-6.module+el8.4.0+570+c2eaf144
python-jinja2
Rocky Linux:8
 before 0:2.10.3-4.module+el8.4.0+570+c2eaf144
0:2.10.3-4.module+el8.4.0+570+c2eaf144
python-markupsafe
Rocky Linux:8
 before 0:1.1.1-6.module+el8.4.0+570+c2eaf144
0:1.1.1-6.module+el8.4.0+570+c2eaf144
python-psutil
Rocky Linux:8
 before 0:5.6.4-3.module+el8.4.0+570+c2eaf144
0:5.6.4-3.module+el8.4.0+570+c2eaf144
python-psycopg2
Rocky Linux:8
 before 0:2.8.4-4.module+el8.6.0+794+eba84017
0:2.8.4-4.module+el8.6.0+794+eba84017
python-psycopg2
Rocky Linux:8
 before 0:2.8.4-4.module+el8.4.0+570+c2eaf144
0:2.8.4-4.module+el8.4.0+570+c2eaf144
python-pycparser
Rocky Linux:8
 before 0:2.19-3.module+el8.4.0+570+c2eaf144
0:2.19-3.module+el8.4.0+570+c2eaf144
python-pysocks
Rocky Linux:8
 before 0:1.7.1-4.module+el8.4.0+570+c2eaf144
0:1.7.1-4.module+el8.4.0+570+c2eaf144
python-requests
Rocky Linux:8
 before 0:2.22.0-9.module+el8.4.0+570+c2eaf144
0:2.22.0-9.module+el8.4.0+570+c2eaf144
python-urllib3
Rocky Linux:8
 before 0:1.25.7-4.module+el8.4.0+570+c2eaf144
0:1.25.7-4.module+el8.4.0+570+c2eaf144
python-wheel
Rocky Linux:8
 before 0:0.33.6-5.module+el8.4.0+570+c2eaf144
0:0.33.6-5.module+el8.4.0+570+c2eaf144
pytz
Rocky Linux:8
 before 0:2019.3-3.module+el8.4.0+570+c2eaf144
0:2019.3-3.module+el8.4.0+570+c2eaf144
PyYAML
Rocky Linux:8
 before 0:5.3.1-1.module+el8.4.0+570+c2eaf144
0:5.3.1-1.module+el8.4.0+570+c2eaf144
scipy
Rocky Linux:8
 before 0:1.3.1-4.module+el8.5.0+672+ab6eb015
0:1.3.1-4.module+el8.5.0+672+ab6eb015
scipy
Rocky Linux:8
 before 0:1.3.1-4.module+el8.4.0+570+c2eaf144
0:1.3.1-4.module+el8.4.0+570+c2eaf144

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-20477 is a critical vulnerability (CVSS 9.8) in Pyyaml, published February 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.11%, the 92nd percentile. Fixed in pyyaml 5.2.

References

Show 46 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open