Lucene search

K
prionPRIOn knowledge basePRION:CVE-2019-20477
HistoryFeb 19, 2020 - 4:15 a.m.

Deserialization of untrusted data

2020-02-1904:15:00
PRIOn knowledge base
www.prio-n.com
12

9.4 High

AI Score

Confidence

High

0.175 Low

EPSS

Percentile

96.2%

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

CPENameOperatorVersion
fedoraeq30
fedoraeq31
pyyamlge5.1
pyyamlle5.1.2