CVE-2020-14343 is a critical arbitrary code execution vulnerability in the PyYAML library, affecting versions prior to 5.4, including Oracle products utilizing it. This flaw allows an unauthenticated attacker to execute arbitrary code by crafting malicious YAML files processed via the full_load method or FullLoader. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector and no user interaction requirement, leading to complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, its high EPSS and FAUCET risk scores indicate significant exploitability potential, and it has received some community and media attention, including a mention in a Microsoft Patch Tuesday article.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.1, < 5.4CPE matchmatch criteria | cpe:2.3:a:pyyaml:pyyaml:*:*:*:*:*:*:*:* | ||
1.10.0CPE matchmatch criteria | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* | ||
22.1.0CPE matchmatch criteria | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2020-14343
Nov 14, 2023Improper Input Validation in PyYAML
Mar 25, 2021A vulnerability was discovered in the PyYAML library in versions before 5.4 where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
Feb 9, 2021PyYAML: incomplete fix for CVE-2020-1747
Jul 22, 2020