CVE-2019-20477
Fixed in a distro release EPSS 5%
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Products: pyyaml, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyyaml | 5.2 |
| PyPI | pyyaml | 5.2b1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | python38-Cython | 0.29.14-4.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-asn1crypto | 1.2.0-3.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-cffi | 1.13.2-3.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-chardet | 3.0.4-19.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-cryptography | 2.8-3.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-idna | 2.8-6.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-markupsafe | 1.1.1-6.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-mod_wsgi | 4.6.8-3.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-psycopg2 | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-psycopg2-doc | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-psycopg2-tests | 2.8.4-4.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-pycparser | 2.19-3.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-pysocks | 1.7.1-4.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-pytz | 2019.3-3.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-requests | 2.22.0-9.module_el8.6.0+2778+cd494b30 |
| AlmaLinux 8 | python38-scipy | 1.3.1-4.module_el8.6.0+2778+cd494b30 |
| Debian 12 | pyyaml | 5.2-1 |
| Debian 13 | pyyaml | 5.2-1 |
| Debian 14 | pyyaml | 5.2-1 |
| Red Hat Enterprise Linux 8 | Cython | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | Cython-debugsource | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | PyYAML | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | PyYAML-debugsource | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | babel | 0:2.7.0-10.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | mod_wsgi | 0:4.6.8-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | numpy | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | numpy-debugsource | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python-PyMySQL | 0:0.9.3-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-asn1crypto | 0:1.2.0-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-cffi | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-cffi-debugsource | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-chardet | 0:3.0.4-19.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-cryptography | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-cryptography-debugsource | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-idna | 0:2.8-6.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-jinja2 | 0:2.10.3-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-lxml | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-lxml-debugsource | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-markupsafe | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-markupsafe-debugsource | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-ply | 0:3.11-8.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-psutil | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-psutil-debugsource | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-psycopg2 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-psycopg2-debugsource | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-pycparser | 0:2.19-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-pysocks | 0:1.7.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-requests | 0:2.22.0-9.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-six | 0:1.12.0-9.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-urllib3 | 0:1.25.7-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python-wheel | 0:0.33.6-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38 | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-Cython | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-Cython-debuginfo | 0:0.29.14-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-PyMySQL | 0:0.9.3-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-asn1crypto | 0:1.2.0-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-babel | 0:2.7.0-10.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-cffi | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-cffi-debuginfo | 0:1.13.2-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-chardet | 0:3.0.4-19.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-cryptography | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-cryptography-debuginfo | 0:2.8-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-debug | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-debuginfo | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-debugsource | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-devel | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-idle | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-idna | 0:2.8-6.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-jinja2 | 0:2.10.3-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-libs | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-lxml | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-lxml-debuginfo | 0:4.4.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-markupsafe | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-markupsafe-debuginfo | 0:1.1.1-6.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-mod_wsgi | 0:4.6.8-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-numpy | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-numpy-debuginfo | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-numpy-doc | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-numpy-f2py | 0:1.17.3-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-pip | 0:19.3.1-1.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-pip-wheel | 0:19.3.1-1.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-ply | 0:3.11-8.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-psutil | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-psutil-debuginfo | 0:5.6.4-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-psycopg2 | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-psycopg2-debuginfo | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-psycopg2-doc | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-psycopg2-tests | 0:2.8.4-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-pycparser | 0:2.19-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-pysocks | 0:1.7.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-pytz | 0:2019.3-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-pyyaml | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-pyyaml-debuginfo | 0:5.3.1-1.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-requests | 0:2.22.0-9.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-rpm-macros | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-scipy | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-scipy-debuginfo | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-setuptools | 0:41.6.0-4.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-setuptools-wheel | 0:41.6.0-4.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-six | 0:1.12.0-9.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-test | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-tkinter | 0:3.8.3-3.module+el8.3.0+7680+79e7e61a |
| Red Hat Enterprise Linux 8 | python38-urllib3 | 0:1.25.7-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | python38-wheel | 0:0.33.6-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python38-wheel-wheel | 0:0.33.6-5.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python3x-pip | 0:19.3.1-1.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | python3x-setuptools | 0:41.6.0-4.module+el8.3.0+7187+a27ec44b |
| Red Hat Enterprise Linux 8 | pytz | 0:2019.3-3.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | scipy | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
| Red Hat Enterprise Linux 8 | scipy-debugsource | 0:1.3.1-4.module+el8.2.0+5234+f98739b6 |
| Rocky Linux 8 | Cython | 0:0.29.14-4.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | PyYAML | 0:5.3.1-1.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | babel | 0:2.7.0-10.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | mod_wsgi | 0:4.6.8-3.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | numpy | 0:1.17.3-5.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-asn1crypto | 0:1.2.0-3.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-cffi | 0:1.13.2-3.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-chardet | 0:3.0.4-19.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-cryptography | 0:2.8-3.module+el8.5.0+672+ab6eb015 |
| Rocky Linux 8 | python-cryptography | 0:2.8-3.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-idna | 0:2.8-6.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-jinja2 | 0:2.10.3-4.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-markupsafe | 0:1.1.1-6.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-psutil | 0:5.6.4-3.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-psycopg2 | 0:2.8.4-4.module+el8.6.0+794+eba84017 |
| Rocky Linux 8 | python-psycopg2 | 0:2.8.4-4.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-pycparser | 0:2.19-3.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-pysocks | 0:1.7.1-4.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-requests | 0:2.22.0-9.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-urllib3 | 0:1.25.7-4.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python-wheel | 0:0.33.6-5.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python3x-pip | 0:19.3.1-1.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | python3x-setuptools | 0:41.6.0-4.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | pytz | 0:2019.3-3.module+el8.4.0+570+c2eaf144 |
| Rocky Linux 8 | scipy | 0:1.3.1-4.module+el8.5.0+672+ab6eb015 |
| Rocky Linux 8 | scipy | 0:1.3.1-4.module+el8.4.0+570+c2eaf144 |