Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 438
Alerts This Week
Warning Icon 1 438

SUSE Linux Enterprise: 2022:2841-1 Critical: Python-PyYAML Code Execution

suse
Calendar Grey August 18, 2022
Scroller Suse
The recent Python-PyYAML update addresses urgent vulnerabilities, particularly those that may lead to arbitrary code execution, impacting a range of SUSE software solutions.
An update that fixes two vulnerabilities is now available

Summary

This update for python-PyYAML fixes the following issues: - CVE-2020-1747: Fixed an arbitrary code execution issue when parsing an untrusted YAML file with the default loader (bsc#1165439). - CVE-2020-14343: Completed the fix for CVE-2020-1747 (bsc#1174514). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-2841=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-2841=1 - SUSE Linux Enterprise Module for Public Cloud 15: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-2022-2841=1

Topics%20covered

Topics Covered

security advisory security issue code execution patch important SUSE Linux Enterprise python-PyYAML

References

#1165439 #1174514

Cross- CVE-2020-14343 CVE-2020-1747

CVSS scores:

CVE-2020-14343 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2020-14343 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2020-1747 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2020-1747 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise High Performance Computing 15

SUSE Linux Enterprise High Performance Computing 15-ESPOS

SUSE Linux Enterprise High Performance Computing 15-LTSS

SUSE Linux Enterprise Module for Public Cloud 15

SUSE Linux Enterprise Server 15

SUSE Linux Enterprise Server 15-LTSS

SUSE Linux Enterprise Server for SAP 15

SUSE Linux Enterprise Server for SAP Applications 15

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:2841-1
Rating: important

Topics%20covered

Topics Covered

security advisory security issue code execution patch important SUSE Linux Enterprise python-PyYAML

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.