Auto-merge PR#3460

Auto-merge PR#3460

2020/1xxx/CVE-2020-1747.json

@@ -4,15 +4,73 @@
     "data_version": "4.0",
     "CVE_data_meta": {
         "ID": "CVE-2020-1747",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "ASSIGNER": "gsuckevi@redhat.com"
+    },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "vendor_name": "Red Hat",
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "PyYAML",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "5.3.1"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    }
+                }
+            ]
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-20"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747",
+                "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747",
+                "refsource": "CONFIRM"
+            },
+            {
+                "url": "https://github.com/yaml/pyyaml/pull/386",
+                "name": "https://github.com/yaml/pyyaml/pull/386",
+                "refsource": "MISC"
+            }
+        ]
     },
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor."
             }
         ]
+    },
+    "impact": {
+        "cvss": [
+            [
+                {
+                    "vectorString": "9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                    "version": "3.0"
+                }
+            ]
+        ]
     }
 }