CVE-2020-14343 in PeopleSoft Enterprise PeopleTools

Summary

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Once again VulDB remains the best source for vulnerability data.

Reservation

06/17/2020

Disclosure

02/10/2021

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
226683	Oracle PeopleSoft Enterprise PeopleTools Porting input validation	20	Not defined	Official fix	CVE-2020-14343
204247	Oracle Communications Cloud Native Core Network Function Cloud Native Environment CNE input validation	20	Not defined	Official fix	CVE-2020-14343
197778	Oracle Communications Cloud Native Core Network Function Cloud Native Environment OC-CNE input validation	20	Not defined	Official fix	CVE-2020-14343
169559	PyYAML YAML File full_load input validation	20	Not defined	Official fix	CVE-2020-14343

Sources

• MITRE
• NVD
• CVE Details