sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2020-14343 Improper Input Validation in PyYAML

Critical 9.8 Published Updated

Attackers can execute arbitrary code by providing malicious YAML files to applications using the vulnerable PyYAML library.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2020-14343?

CVE-2020-14343 is a critical code injection vulnerability in PyYAML, published on 9 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Weakness: CWE-20

Which versions are affected by CVE-2020-14343?

3 open source packages ship an affected version, including pyyaml and PyYAML. It affects 2 products.

PackageAffectedFixed in
pyyaml PyPIAll versions5.4
pyyaml PyPIAll versions5.4
PyYAML PyPIAll versions5.4
Linux distribution packages (37)
Cython Red Hat:enterprise_linux:8::appstreamAll versions0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Cython-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:0.29.14-4.module+el8.4.0+8888+89bc7e79
PyYAML Red Hat:enterprise_linux:8::appstreamAll versions0:5.4.1-1.module+el8.4.0+10706+5c295a3e
PyYAML-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:5.4.1-1.module+el8.4.0+10706+5c295a3e
babel Red Hat:enterprise_linux:8::appstreamAll versions0:2.7.0-10.module+el8.4.0+8888+89bc7e79
mod_wsgi Red Hat:enterprise_linux:8::appstreamAll versions0:4.6.8-3.module+el8.4.0+8888+89bc7e79
numpy Red Hat:enterprise_linux:8::appstreamAll versions0:1.17.3-5.module+el8.4.0+8888+89bc7e79
numpy-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:1.17.3-5.module+el8.4.0+8888+89bc7e79
python-PyMySQL Red Hat:enterprise_linux:8::appstreamAll versions0:0.10.1-1.module+el8.4.0+9692+8e86ab84
python-asn1crypto Red Hat:enterprise_linux:8::appstreamAll versions0:1.2.0-3.module+el8.4.0+8888+89bc7e79
python-cffi Red Hat:enterprise_linux:8::appstreamAll versions0:1.13.2-3.module+el8.4.0+8888+89bc7e79
python-cffi-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:1.13.2-3.module+el8.4.0+8888+89bc7e79
python-chardet Red Hat:enterprise_linux:8::appstreamAll versions0:3.0.4-19.module+el8.4.0+8888+89bc7e79
python-cryptography Red Hat:enterprise_linux:8::appstreamAll versions0:2.8-3.module+el8.4.0+8888+89bc7e79
python-cryptography-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:2.8-3.module+el8.4.0+8888+89bc7e79
python-idna Red Hat:enterprise_linux:8::appstreamAll versions0:2.8-6.module+el8.4.0+8888+89bc7e79
python-jinja2 Red Hat:enterprise_linux:8::appstreamAll versions0:2.10.3-4.module+el8.4.0+8888+89bc7e79
python-lxml Red Hat:enterprise_linux:8::appstreamAll versions0:4.4.1-5.module+el8.4.0+9001+fc421f6c
python-lxml-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:4.4.1-5.module+el8.4.0+9001+fc421f6c
python-markupsafe Red Hat:enterprise_linux:8::appstreamAll versions0:1.1.1-6.module+el8.4.0+8888+89bc7e79
python-markupsafe-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:1.1.1-6.module+el8.4.0+8888+89bc7e79
python-ply Red Hat:enterprise_linux:8::appstreamAll versions0:3.11-10.module+el8.4.0+9579+e9717e18
python-psutil Red Hat:enterprise_linux:8::appstreamAll versions0:5.6.4-3.module+el8.4.0+8888+89bc7e79
python-psutil-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:5.6.4-3.module+el8.4.0+8888+89bc7e79
python-psycopg2 Red Hat:enterprise_linux:8::appstreamAll versions0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python-psycopg2-debugsource Red Hat:enterprise_linux:8::appstreamAll versions0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python-pycparser Red Hat:enterprise_linux:8::appstreamAll versions0:2.19-3.module+el8.4.0+8888+89bc7e79
python-pysocks Red Hat:enterprise_linux:8::appstreamAll versions0:1.7.1-4.module+el8.4.0+8888+89bc7e79
python-requests Red Hat:enterprise_linux:8::appstreamAll versions0:2.22.0-9.module+el8.4.0+8888+89bc7e79
python-urllib3 Red Hat:enterprise_linux:8::appstreamAll versions0:1.25.7-4.module+el8.4.0+8888+89bc7e79
python-wheel Red Hat:enterprise_linux:8::appstreamAll versions0:0.33.6-5.module+el8.4.0+8888+89bc7e79
python38 Red Hat:enterprise_linux:8::appstreamAll versions0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-Cython Red Hat:enterprise_linux:8::appstreamAll versions0:0.29.14-4.module+el8.4.0+8888+89bc7e79
python38-Cython-debuginfo Red Hat:enterprise_linux:8::appstreamAll versions0:0.29.14-4.module+el8.4.0+8888+89bc7e79
python38-PyMySQL Red Hat:enterprise_linux:8::appstreamAll versions0:0.10.1-1.module+el8.4.0+9692+8e86ab84
python38-asn1crypto Red Hat:enterprise_linux:8::appstreamAll versions0:1.2.0-3.module+el8.4.0+8888+89bc7e79
python38-babel Red Hat:enterprise_linux:8::appstreamAll versions0:2.7.0-10.module+el8.4.0+8888+89bc7e79

Products include Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Pyyaml Pyyaml.

How do I fix CVE-2020-14343?

Upgrade pyyaml to 5.4 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-14343 being exploited?

There is no known exploitation of CVE-2020-14343 in the wild and no public exploit code.

Public exploit code: 4 proofs of concept on GitHub.

Sources

Also known as ALPINE-CVE-2020-14343, AZL-31782, CLSA-2025-1762733645, DEBIAN-CVE-2020-14343, GHSA-8q59-q68h-6hv4, MGASA-2021-0119 and 9 more.

Is CVE-2020-14343 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free