The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_4641 advisory.

    * PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

    * python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

    * PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

    * python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

    * python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2841-1 advisory.

    - CVE-2020-1747: Fixed an arbitrary code execution issue when parsing       an untrusted YAML file with the default loader (bsc#1165439).
    - CVE-2020-14343: Completed the fix for CVE-2020-1747 (bsc#1174514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A vulnerability was discovered in the PyYAML library in     versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted     YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to     process untrusted input may be vulnerable to this flaw.
    An attacker could use this flaw to execute arbitrary     code on the system by abusing the python/object/new     constructor.(CVE-2020-1747)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4641 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python38 (3.8.3). (BZ#1847416)

    Security Fix(es):

    * PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)

    * python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

    * PyYAML: arbitrary command execution through python/object/new when FullLoader is used (CVE-2020-1747)

    * python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

    * python: DoS via inefficiency in IPv{4,6}Interface classes (CVE-2020-14422)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0269 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2017-18342:
    In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The     load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward     compatibility with the function.

    CVE-2020-14343:
    A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

    CVE-2020-1747:
    A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-3342569a0f advisory.

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

  - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. (CVE-2020-14343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- New upstream release 5.3.1 (rhbz#1814882)

  - Fixes CVE-2020-1747 (rhbz#1807367,1809011)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-PyYAML fixes the following issues :

  - CVE-2020-1747: Fixed an arbitrary code execution when     YAML files are parsed by FullLoader (bsc#1165439).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4641 advisory.

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a     class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists     because of an incomplete fix for CVE-2017-18342. (CVE-2019-20477)

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-eed7193502 advisory.

  - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the     python/object/new constructor. (CVE-2020-1747)

  - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to     arbitrary code execution when it processes untrusted YAML files through the full_load method or with the     FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this     flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the     python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. (CVE-2020-14343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
357637	Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2020_4641)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
164306	SUSE SLES15 Security Update : python-PyYAML (SUSE-SU-2022:2841-1)	Nessus	SuSE Local Security Checks	2022/8/20	2026/6/25	critical
140015	EulerOS Virtualization for ARM 64 3.0.6.0 : PyYAML (EulerOS-SA-2020-1912)	Nessus	Huawei Local Security Checks	2020/8/28	2024/2/22	critical
142431	RHEL 8 : python38:3.8 (RHSA-2020:4641)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	critical
235945	Alibaba Cloud Linux 3 : 0269: PyYAML (ALINUX3-SA-2024:0269)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
145367	Fedora 33 : PyYAML (2021-3342569a0f)	Nessus	Fedora Local Security Checks	2021/1/25	2025/12/2	critical
134996	Fedora 31 : PyYAML (2020-bdb0bfa928)	Nessus	Fedora Local Security Checks	2020/3/30	2024/3/20	critical
136456	openSUSE Security Update : python-PyYAML (openSUSE-2020-630)	Nessus	SuSE Local Security Checks	2020/5/11	2024/3/13	critical
180934	Oracle Linux 8 : python38:3.8 (ELSA-2020-4641)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	critical
145763	Fedora 32 : PyYAML (2021-eed7193502)	Nessus	Fedora Local Security Checks	2021/2/1	2025/12/2	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical