Bug 1807367 (CVE-2020-1747) - CVE-2020-1747 PyYAML: arbitrary command execution through python/object/new when FullLoader is used
Summary: CVE-2020-1747 PyYAML: arbitrary command execution through python/object/new w...
Alias: CVE-2020-1747
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1809010 1809011 1810083 1910658
Blocks: 1807368
TreeView+ depends on / blocked
Reported: 2020-02-26 08:26 UTC by Riccardo Schirone
Modified: 2021-02-08 11:22 UTC (History)
19 users (show)

Fixed In Version: PyYAML 5.3.1
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Clone Of:
Last Closed: 2020-11-04 02:24:31 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4641 0 None None None 2020-11-04 02:35:50 UTC

Description Riccardo Schirone 2020-02-26 08:26:35 UTC
An arbitrary code execution was discovered in PyYAML when YAML files are parsed by FullLoader. This loader is used by default by yaml.load() when no loader is specified or when yaml.full_load() is used. Applications that use PyYAML to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to execute arbitrary code on the system, by abusing the python/object/new constructor.

Comment 1 Riccardo Schirone 2020-02-26 08:26:38 UTC

Name: Riccardo Schirone (Red Hat)

Comment 2 Riccardo Schirone 2020-02-26 10:39:25 UTC
FullLoader, which is the class where this vulnerability lies, was introduced in upstream version 5.1.

Comment 3 Riccardo Schirone 2020-02-26 10:39:46 UTC
Even though the CVSS is 9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the Impact of this flaw is set to Medium as `yaml.load`/`yaml.full_load` should not be used on untrusted input. When untrusted input needs to be parsed, `SafeLoader` or `yaml.safe_load` must be used instead. This has been documented for a very long time in PyYAML.

Comment 5 Riccardo Schirone 2020-02-26 10:43:27 UTC

Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.

Comment 7 Jason Shepherd 2020-02-27 00:50:23 UTC

Red Hat Quay 3.2 uses the vulnerable load function, but only to parse the Nginx configuration file, which only contains trusted data.

Comment 11 Riccardo Schirone 2020-03-02 08:49:58 UTC
Upstream PR:

Comment 13 Riccardo Schirone 2020-03-02 09:36:07 UTC
Created PyYAML tracking bugs for this issue:

Affects: fedora-all [bug 1809011]

Comment 17 Summer Long 2020-03-05 03:51:49 UTC
OpenStack: set to 'notaffected' because the packaged RHOSP version (PyYAML-3.10-11.el7) doesn't have the FullLoader code (lib/yaml/loader.py and constructor.py).

Comment 18 Riccardo Schirone 2020-03-24 09:05:43 UTC
Upstream fix:

Comment 19 Product Security DevOps Team 2020-11-04 02:24:31 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 20 errata-xmlrpc 2020-11-04 02:35:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4641 https://access.redhat.com/errata/RHSA-2020:4641

Note You need to log in before you can comment on or make changes to this bug.