CVE-2020-14343

Katalog CVE

CVSS 9.8 · Critical EPSS 6,0%

Kerentanan Improper Input Validation pada pyyaml, oracle communications cloud native core network function cloud native environment. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Rincian

Terbit di NVD

9 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

6,0% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1860466 issue tracking · advisory pihak ketiga
• https://github.com/SeldonIO/seldon-core/issues/2252
• https://github.com/yaml/pyyaml/issues/420