You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
Jul 5, 2021
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
Sep 14, 2021
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
Sep 16, 2021
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
Dec 31, 2021
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
Jan 18, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
Jan 27, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
Mar 22, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
Mar 23, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
Mar 29, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
Apr 5, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
Apr 12, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
Apr 15, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
Apr 15, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.zip
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
Apr 16, 2022
mend-bolt-for-githubbot
changed the title
CVE-2020-14343 (High) detected in PyYAML-3.12.tar.gz
CVE-2020-14343 (Critical) detected in PyYAML-3.12.tar.gz
Jul 27, 2023
CVE-2020-14343 - Critical Severity Vulnerability
Vulnerable Library - PyYAML-3.12.tar.gz
YAML parser and emitter for Python
Library home page: https://files.pythonhosted.org/packages/4a/85/db5a2df477072b2902b0eb892feb37d88ac635d36245a72a6a69b23b383a/PyYAML-3.12.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 7e49f2cde2297de37b4f42690262790abdd3459d
Found in base branch: master
Vulnerability Details
A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
Publish Date: 2021-02-09
URL: CVE-2020-14343
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14343
Release Date: 2021-02-09
Fix Resolution: 5.4
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: