FLAT-XCM34 – Vulnerability | Fluid Attacks Database

Database

Description

arbitrary code execution

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	pyyaml	>=0 <5.4	5.4
alpine v3.12	py3-yaml	>=0 <5.3.1-r1	5.3.1-r1
alpine v3.19	py3-yaml	>=0 <5.4-r0	5.4-r0
alpine v3.14	py3-yaml	>=0 <5.4-r0	5.4-r0
alpine v3.15	py3-yaml	>=0 <5.4-r0	5.4-r0
alpine v3.16	py3-yaml	>=0 <5.4-r0	5.4-r0
alpine v3.18	py3-yaml	>=0 <5.4-r0	5.4-r0
alpine v3.20	py3-yaml	>=0 <5.4-r0	5.4-r0
debian 12	pyyaml	>=0 <5.3.1-4	5.3.1-4
debian 13	pyyaml	>=0 <5.3.1-4	5.3.1-4

1-10 of 22

10

Aliases

1. CVE-2020-143432. NVD-2020-143433. OSV-2020-143434. OSV-ALPINE-2020-143435. OSV-DEBIAN-2020-143436. GHSA-8q59-q68h-6hv47. GCVE-2020-143438. SECURITY-CVE-2020-143439. SECURITY-TRACKER-CVE-2020-14343

References

1. https://github.com/SeldonIO/seldon-core/issues/22522. https://github.com/yaml/pyyaml/issues/4203. https://github.com/yaml/pyyaml/issues/420#issuecomment-6636739664. https://github.com/yaml/pyyaml/commit/a001f2782501ad2d24986959f0239a354675f9dc5. https://bugzilla.redhat.com/show_bug.cgi?id=18604666. https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2021-142.yaml7. https://pypi.org/project/PyYAML8. https://www.oracle.com/security-alerts/cpuapr2022.html9. https://www.oracle.com/security-alerts/cpujul2022.html10. https://github.com/j4k0m/loader-CVE-2020-14343

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.