Python3-pyyaml-3.12-12 detected as vulnerable on rocky 8-CVE-2020-14343

Rocky Linux Help & Support
1

Hi,

From one of our sec tool as detected python3-pyyaml-3.12-12 as vulnerable on rocky 8. This is the latest version available at rocky8 upstream.Is CVE-2020-14343 associated with is fixed ?

Any links with the fix will help us.

2

The python3-pyyaml-3.12-12.el8 is a library/module for Python 3.6 – the “platform Python”.

The cve-details states that PyYAML of RHEL 8 is “Not Affected”.

They do note that some Red Hat applications do use affected version of PyYAML,
but they either call “safe_load” or specify SafeLoader when callitg “load”.

The question is thus, do you have applications that do not use the safe methods?
(Naturally, any user could write Python script that does use the unsafe methods.)

1 Like