PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

An update of the PyYAML package has been released.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4641 advisory.

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a     class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists     because of an incomplete fix for CVE-2017-18342. (CVE-2019-20477)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4641 advisory.

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a     class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists     because of an incomplete fix for CVE-2017-18342. (CVE-2019-20477)

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the PyYAML package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in the implementation of the Short     Message Service (SMS) handling functionality of Cisco     IOS Software and Cisco IOS XE Software could allow an     unauthenticated, remote attacker to trigger a denial of     service (DoS) condition on an affected device. The     vulnerability is due to improper processing of SMS     protocol data units (PDUs) that are encoded with a     special character set. An attacker could exploit this     vulnerability by sending a malicious SMS message to an     affected device. A successful exploit could allow the     attacker to cause the wireless WAN (WWAN) cellular     interface module on an affected device to crash,     resulting in a DoS condition that would require manual     intervention to restore normal operating conditions.
    (CVE-2019-1747)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342. (CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4641 advisory.

  - PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

  - python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

  - python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

  - PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

  - python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the PyYAML package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in the implementation of the Short     Message Service (SMS) handling functionality of Cisco     IOS Software and Cisco IOS XE Software could allow an     unauthenticated, remote attacker to trigger a denial of     service (DoS) condition on an affected device. The     vulnerability is due to improper processing of SMS     protocol data units (PDUs) that are encoded with a     special character set. An attacker could exploit this     vulnerability by sending a malicious SMS message to an     affected device. A successful exploit could allow the     attacker to cause the wireless WAN (WWAN) cellular     interface module on an affected device to crash,     resulting in a DoS condition that would require manual     intervention to restore normal operating     conditions.(CVE-2019-1747)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4641 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)

    Security Fix(es):

    * PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

    * python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

    * PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

    * python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

    * python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the PyYAML package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - YAML is a data serialization format designed for human     readability and interaction with scripting languages.
    PyYAML is a YAML parser and emitter for Python. PyYAML     features a complete YAML 1.1 parser, Unicode support,     pickle support, capable extension API, and sensible     error messages. PyYAML supports standard YAML tags and     provides Python-specific tags that allow to represent     an arbitrary Python object. PyYAML is applicable for a     broad range of tasks from complex configuration files     to object serialization and persistance.Security     Fix(es):A vulnerability was discovered in the PyYAML     library in versions before 5.3.1, where it is     susceptible to arbitrary code execution when it     processes untrusted YAML files through the full_load     method or with the FullLoader loader. Applications that     use the library to process untrusted input may be     vulnerable to this flaw. An attacker could use this     flaw to execute arbitrary code on the system by abusing     the python/object/new constructor.(CVE-2020-1747)PyYAML     5.1 through 5.1.2 has insufficient restrictions on the     load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in the PyYAML library in     versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted     YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to     process untrusted input may be vulnerable to this flaw.
    An attacker could use this flaw to execute arbitrary     code on the system by abusing the python/object/new     constructor.(CVE-2020-1747)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the PyYAML packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-20477

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203117	Photon OS 3.0: Pyyaml PHSA-2020-3.0-0067	Nessus	PhotonOS Local Security Checks	critical
203089	Photon OS 2.0: Pyyaml PHSA-2020-2.0-0217	Nessus	PhotonOS Local Security Checks	critical
196325	RHEL 6 : pyyaml (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
184747	Rocky Linux 8 : python38:3.8 (RLSA-2020:4641)	Nessus	Rocky Linux Local Security Checks	critical
180934	Oracle Linux 8 : python38:3.8 (ELSA-2020-4641)	Nessus	Oracle Linux Local Security Checks	critical
151393	EulerOS Virtualization 3.0.2.2 : PyYAML (EulerOS-SA-2021-2165)	Nessus	Huawei Local Security Checks	critical
146036	CentOS 8 : python38:3.8 (CESA-2020:4641)	Nessus	CentOS Local Security Checks	critical
142568	EulerOS Virtualization 3.0.6.6 : PyYAML (EulerOS-SA-2020-2475)	Nessus	Huawei Local Security Checks	critical
142431	RHEL 8 : python38:3.8 (RHSA-2020:4641)	Nessus	Red Hat Local Security Checks	critical
142093	EulerOS 2.0 SP5 : PyYAML (EulerOS-SA-2020-2269)	Nessus	Huawei Local Security Checks	critical
140318	EulerOS Virtualization for ARM 64 3.0.2.0 : PyYAML (EulerOS-SA-2020-1948)	Nessus	Huawei Local Security Checks	critical
135158	EulerOS Virtualization for ARM 64 3.0.6.0 : PyYAML (EulerOS-SA-2020-1371)	Nessus	Huawei Local Security Checks	critical
134789	EulerOS 2.0 SP8 : PyYAML (EulerOS-SA-2020-1297)	Nessus	Huawei Local Security Checks	critical
134424	Photon OS 1.0: Pyyaml PHSA-2020-1.0-0283	Nessus	PhotonOS Local Security Checks	critical
134189	Fedora 30 : PyYAML (2020-e84e90dc4a)	Nessus	Fedora Local Security Checks	critical
134186	Fedora 31 : PyYAML (2020-3162499159)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2019-20477

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical