The fix made in PyYAML for CVE-2020-1747 was not sufficient to resolve the issue. Reference: https://github.com/yaml/pyyaml/issues/420
Created PyYAML tracking bugs for this issue: Affects: fedora-all [bug 1860469] Created python2-pyyaml tracking bugs for this issue: Affects: epel-all [bug 1860470] Created python3-PyYAML tracking bugs for this issue: Affects: epel-all [bug 1860468]
OpenStack: set to 'notaffected' because the packaged RHOSP version (PyYAML-3.10-11.el7) doesn't have the FullLoader code (lib/yaml/loader.py and constructor.py).
Mitigation: Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.
FullLoader, which is the class where this vulnerability lies, was introduced in upstream version 5.1.
The fix for CVE-2020-1747 was to implement a blacklist that prevented some properties to be set when deserializing python objects. However, it is still possible to bypass such blacklist by carefully nesting objects.
Upstream opinion on the topic: https://github.com/yaml/pyyaml/issues/420#issuecomment-696752389 .
Oops sorry closed the wrong bug. Currently getting fixed in Fedora here - https://bugzilla.redhat.com/show_bug.cgi?id=1916496 Once it goes stable I'll update the fedora CVE bug.
Upstream fix: https://github.com/yaml/pyyaml/pull/472
Statement: Ansible Tower 3.7 uses affected version of PyYAML 3.12 from RHEL, but the use of load() is specified with a SafeLoader when it is called. So Ansible Tower and Ansible Engine are not affected. Red Hat Quay, from version 3.4 uses the safe_load function which is not affected by this issue. See [1]. Even though the CVSSv3 for this flaw is 9.8, the Impact has been set to Moderate because PyYAML provides a specific method to deal with untrusted input, which is `yaml.safe_load`. `yaml.safe_load` or the SafeLoader loader should be used whenever the input YAML can be modified by a malicious user. [1] https://github.com/quay/quay/pull/603
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:2583 https://access.redhat.com/errata/RHSA-2021:2583
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14343
This issue has been addressed in the following products: Red Hat Satellite 6.10 for RHEL 7 Via RHSA-2021:4702 https://access.redhat.com/errata/RHSA-2021:4702