Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2019-20477
9.8
CRITICALCVSS v3
Published
February 19, 2020
CVSS v2
7.5 HIGH
Affected
5 projects
Assigned by
MITRE
Severity scale
010
Description
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
GitHub
Crates.io
fedora
Docker Hub
NPM
RubyGems