Bug 1164458 – VUL-0: CVE-2019-20478: python-ruamel.yaml: load method allows remote code execution with an untrusted argument

Bug 1164458 - (CVE-2019-20478) VUL-0: CVE-2019-20478: python-ruamel.yaml: load method allows remote code execution with an untrusted argument

(CVE-2019-20478)
Summary:	VUL-0: CVE-2019-20478: python-ruamel.yaml: load method allows remote code exe...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Robert Schweikert
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/253331/
Whiteboard:	CVSSv3.1:SUSE:CVE-2019-20478:7.3:(AV...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2020-02-20 10:18 UTC by Alexander Bergmann
Modified:	2022-09-20 12:56 UTC (History)
CC List:	8 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Flags:	abergmann: needinfo? (rjschwei)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2020-02-20 10:18:22 UTC

CVE-2019-20478

In ruamel.yaml through 0.16.7, the load method allows remote code execution if
the application calls this method with an untrusted argument. In other words,
this issue affects developers who are unaware of the need to use methods such as
safe_load in these use cases.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20478
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-20478.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20478
https://www.exploit-db.com/exploits/47655

Comment 8 Ondřej Súkup 2022-08-03 07:53:55 UTC

note: version 0.15.+ has api change in load/dump

Comment 9 Thomas Leroy 2022-09-20 12:56:28 UTC

For SUSE:SLE-12:Update, a mitigation is better than an version update.
The 'safe_load' method from python-ruamel.yaml v0.12.14 is always preferred over the 'load' method. Using 'safe_load' will prevent RCE by an insecure deserialization.

The other codestreams are fixed, closing