CVE-2020-14343: oracle communications_cloud_native_core_network_function_cloud_native_environment Improper Input Validation

Modified

AliasesALPINE-CVE-2020-14343MGASA-2021-0119SUSE-SU-2021:2818-1+8 more

Published 09-02-2021Last modified 04-08-2024

Vulnerability summary

CVE-2020-14343 is a high (CVSS 10.0) Improper Input Validation vulnerability in oracle communications_cloud_native_core_network_function_cloud_native_environment. EPSS estimates a 5.98% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 6% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

5.98%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 7

OPENSUSE-SU-2024:11108-1 OPENSUSE-SU-2024:11210-1 OPENSUSE-SU-2024:14089-1 OPENSUSE-SU-2026:11996-1 RHSA-2021:4702 SUSE-RU-2021:0985-1+2 more

Timeline

09-02-2021
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

CVSS metrics

8 scores · 6 sources · 3 versions

v4.09.3v3.19.8v2.010.0

EPSS trend

Probability

5.98%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.98% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat109 products

babel< 0:2.7.0-10.module+el8.4.0+8888+89bc7e79
Cython< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Cython-debugsource< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
mod_wsgi< 0:4.6.8-3.module+el8.4.0+8888+89bc7e79
numpy< 0:1.17.3-5.module+el8.4.0+8888+89bc7e79

numpy-debugsource< 0:1.17.3-5.module+el8.4.0+8888+89bc7e79
pytest< 0:4.6.6-3.module+el8.4.0+8888+89bc7e79
python-asn1crypto< 0:1.2.0-3.module+el8.4.0+8888+89bc7e79
python-atomicwrites< 0:1.3.0-8.module+el8.4.0+8888+89bc7e79
python-attrs< 0:19.3.0-3.module+el8.4.0+8888+89bc7e79
python-cffi< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
python-cffi-debugsource< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
python-chardet< 0:3.0.4-19.module+el8.4.0+8888+89bc7e79
python-cryptography< 0:2.8-3.module+el8.4.0+8888+89bc7e79
python-cryptography-debugsource< 0:2.8-3.module+el8.4.0+8888+89bc7e79
python-idna< 0:2.8-6.module+el8.4.0+8888+89bc7e79
python-jinja2< 0:2.10.3-4.module+el8.4.0+8888+89bc7e79
python-lxml< 0:4.4.1-5.module+el8.4.0+9001+fc421f6c
python-lxml-debugsource< 0:4.4.1-5.module+el8.4.0+9001+fc421f6c
python-markupsafe< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
python-markupsafe-debugsource< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
python-more-itertools< 0:7.2.0-5.module+el8.4.0+8888+89bc7e79
python-packaging< 0:19.2-3.module+el8.4.0+8888+89bc7e79
python-pluggy< 0:0.13.0-3.module+el8.4.0+8888+89bc7e79
python-ply< 0:3.11-10.module+el8.4.0+9579+e9717e18
python-psutil< 0:5.6.4-3.module+el8.4.0+8888+89bc7e79
python-psutil-debugsource< 0:5.6.4-3.module+el8.4.0+8888+89bc7e79
python-psycopg2< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python-psycopg2-debugsource< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python-py< 0:1.8.0-8.module+el8.4.0+8888+89bc7e79
python-pycparser< 0:2.19-3.module+el8.4.0+8888+89bc7e79
python-PyMySQL< 0:0.10.1-1.module+el8.4.0+9692+8e86ab84
python-pysocks< 0:1.7.1-4.module+el8.4.0+8888+89bc7e79
python-requests< 0:2.22.0-9.module+el8.4.0+8888+89bc7e79
python-urllib3< 0:1.25.7-4.module+el8.4.0+8888+89bc7e79
python-wcwidth< 0:0.1.7-16.module+el8.4.0+8888+89bc7e79
python-wheel< 0:0.33.6-5.module+el8.4.0+8888+89bc7e79
python38< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-asn1crypto< 0:1.2.0-3.module+el8.4.0+8888+89bc7e79
python38-atomicwrites< 0:1.3.0-8.module+el8.4.0+8888+89bc7e79
python38-attrs< 0:19.3.0-3.module+el8.4.0+8888+89bc7e79
python38-babel< 0:2.7.0-10.module+el8.4.0+8888+89bc7e79
python38-cffi< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
python38-cffi-debuginfo< 0:1.13.2-3.module+el8.4.0+8888+89bc7e79
python38-chardet< 0:3.0.4-19.module+el8.4.0+8888+89bc7e79
python38-cryptography< 0:2.8-3.module+el8.4.0+8888+89bc7e79
python38-cryptography-debuginfo< 0:2.8-3.module+el8.4.0+8888+89bc7e79
python38-Cython< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
python38-Cython-debuginfo< 0:0.29.14-4.module+el8.4.0+8888+89bc7e79
python38-debug< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-debuginfo< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-debugsource< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-devel< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-idle< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-idna< 0:2.8-6.module+el8.4.0+8888+89bc7e79
python38-jinja2< 0:2.10.3-4.module+el8.4.0+8888+89bc7e79
python38-libs< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-lxml< 0:4.4.1-5.module+el8.4.0+9001+fc421f6c
python38-lxml-debuginfo< 0:4.4.1-5.module+el8.4.0+9001+fc421f6c
python38-markupsafe< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
python38-markupsafe-debuginfo< 0:1.1.1-6.module+el8.4.0+8888+89bc7e79
python38-mod_wsgi< 0:4.6.8-3.module+el8.4.0+8888+89bc7e79
python38-more-itertools< 0:7.2.0-5.module+el8.4.0+8888+89bc7e79
python38-numpy< 0:1.17.3-5.module+el8.4.0+8888+89bc7e79
python38-numpy-debuginfo< 0:1.17.3-5.module+el8.4.0+8888+89bc7e79
python38-numpy-doc< 0:1.17.3-5.module+el8.4.0+8888+89bc7e79
python38-numpy-f2py< 0:1.17.3-5.module+el8.4.0+8888+89bc7e79
python38-packaging< 0:19.2-3.module+el8.4.0+8888+89bc7e79
python38-pip< 0:19.3.1-1.module+el8.4.0+8888+89bc7e79
python38-pip-wheel< 0:19.3.1-1.module+el8.4.0+8888+89bc7e79
python38-pluggy< 0:0.13.0-3.module+el8.4.0+8888+89bc7e79
python38-ply< 0:3.11-10.module+el8.4.0+9579+e9717e18
python38-psutil< 0:5.6.4-3.module+el8.4.0+8888+89bc7e79
python38-psutil-debuginfo< 0:5.6.4-3.module+el8.4.0+8888+89bc7e79
python38-psycopg2< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python38-psycopg2-debuginfo< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python38-psycopg2-doc< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python38-psycopg2-tests< 0:2.8.4-4.module+el8.4.0+8888+89bc7e79
python38-py< 0:1.8.0-8.module+el8.4.0+8888+89bc7e79
python38-pycparser< 0:2.19-3.module+el8.4.0+8888+89bc7e79
python38-PyMySQL< 0:0.10.1-1.module+el8.4.0+9692+8e86ab84
python38-pyparsing< 0:2.4.5-3.module+el8.4.0+8888+89bc7e79
python38-pysocks< 0:1.7.1-4.module+el8.4.0+8888+89bc7e79
python38-pytest< 0:4.6.6-3.module+el8.4.0+8888+89bc7e79
python38-pytz< 0:2019.3-3.module+el8.4.0+8888+89bc7e79
python38-pyyaml< 0:5.4.1-1.module+el8.4.0+10706+5c295a3e
python38-pyyaml-debuginfo< 0:5.4.1-1.module+el8.4.0+10706+5c295a3e
python38-requests< 0:2.22.0-9.module+el8.4.0+8888+89bc7e79
python38-rpm-macros< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-scipy< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79
python38-scipy-debuginfo< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79
python38-setuptools< 0:41.6.0-4.module+el8.4.0+8888+89bc7e79
python38-setuptools-wheel< 0:41.6.0-4.module+el8.4.0+8888+89bc7e79
python38-six< 0:1.12.0-10.module+el8.4.0+8888+89bc7e79
python38-test< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-tkinter< 0:3.8.6-3.module+el8.4.0+9579+e9717e18
python38-urllib3< 0:1.25.7-4.module+el8.4.0+8888+89bc7e79
python38-wcwidth< 0:0.1.7-16.module+el8.4.0+8888+89bc7e79
python38-wheel< 0:0.33.6-5.module+el8.4.0+8888+89bc7e79
python38-wheel-wheel< 0:0.33.6-5.module+el8.4.0+8888+89bc7e79
python3x-pip< 0:19.3.1-1.module+el8.4.0+8888+89bc7e79
python3x-pyparsing< 0:2.4.5-3.module+el8.4.0+8888+89bc7e79
python3x-setuptools< 0:41.6.0-4.module+el8.4.0+8888+89bc7e79
python3x-six< 0:1.12.0-10.module+el8.4.0+8888+89bc7e79
pytz< 0:2019.3-3.module+el8.4.0+8888+89bc7e79
PyYAML< 0:5.4.1-1.module+el8.4.0+10706+5c295a3e
PyYAML-debugsource< 0:5.4.1-1.module+el8.4.0+10706+5c295a3e
scipy< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79
scipy-debugsource< 0:1.3.1-4.module+el8.4.0+8888+89bc7e79

Show all 109

Suse20 products

python-PyYAML&distro=HPE Helion OpenStack 8< 5.3.1-28.6.1
python-PyYAML&distro=SUSE Linux Enterprise Module for Advanced Systems Management 12< 5.1.2-26.15.1
python-PyYAML&distro=SUSE Linux Enterprise Module for Containers 12< 5.1.2-26.15.1
python-PyYAML&distro=SUSE Linux Enterprise Module for Public Cloud 12< 5.3.1-28.6.1
python-PyYAML&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 5.3.1-28.6.1

Show all 20

Alpine1 product

py3-yaml< 5.3.1-r1 | < 5.3.1-r2 | < 5.4-r0

Debian1 product

pyyaml< 5.3.1-4

Mageia1 product

python-yaml< 5.3.1-1.1.mga7

Oracle1 product

communications_cloud_native_core_network_function_cloud_native_environment1.10.0 | 22.1.0

PyPI1 product

pyyaml< 5.4

Pyyaml1 product

pyyaml≥ 5.1, < 5.4

Ubuntu1 product

pyyaml< 5.3.1-1ubuntu0.1

9 vendors · 136 products

References

30 links

github.com/yaml/pyyaml/issues/420WEB
bugzilla.redhat.com/show_bug.cgi?id=1860466WEBREPORTIssue TrackingThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujul2022.htmlWEBPatchThird Party Advisory
github.com/SeldonIO/seldon-core/issues/2252WEB
security.alpinelinux.org/vuln/CVE-2020-14343Advisory
advisories.mageia.org/MGASA-2021-0119.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=28205REPORT
lists.fedoraproject.org/archives/…WEB
www.suse.com/support/update/announcement/2021/suse-su-20212818-1/Advisory

Show all 30 references