Skip to content
Heist/ feed
UnratedFix available

Security update for python-PyYAML

Type: advisorySource: OSV1 source record

This update for python-PyYAML fixes the following issues: - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Announced Source revision 1
Original source ↗

SUSE-SU-2026:4402-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:SUSE-SU-2026:4402-1

python3-PyYAML

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
5.3.1-32.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

python3-PyYAML

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
5.3.1-32.1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

python3-PyYAML

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
5.3.1-32.1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "5.3.1-32.1"
          }
        ]
      }
    ],
    "package": {
      "name": "python3-PyYAML",
      "purl": "pkg:rpm/suse/python3-PyYAML&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2012",
      "ecosystem": "SUSE:Linux Enterprise Module for Public Cloud 12"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4402-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "python3-PyYAML": "5.3.1-32.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "5.3.1-32.1"
          }
        ]
      }
    ],
    "package": {
      "name": "python3-PyYAML",
      "purl": "pkg:rpm/suse/python3-PyYAML&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS",
      "ecosystem": "SUSE:Linux Enterprise Server 12 SP5-LTSS"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4402-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "python3-PyYAML": "5.3.1-32.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "5.3.1-32.1"
          }
        ]
      }
    ],
    "package": {
      "name": "python3-PyYAML",
      "purl": "pkg:rpm/suse/python3-PyYAML&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5",
      "ecosystem": "SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4402-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "python3-PyYAML": "5.3.1-32.1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#60848 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement