|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2017-18640: snakeyaml: The Alias feature allows entity expansion during a load operation | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Alexandros Toptsoglou <atoptsoglou> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | fstrba, gianluca.gabrielli, pmonrealgonzalez, postadal, rpm, smash_bz |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/248814/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2017-18640:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Alexandros Toptsoglou
2019-12-18 16:49:30 UTC
According to [0], upstream is not inclined to fix this and they point the user to be careful about the input, see [1]. This was addressed in the past and the test src/test/java/org/yaml/snakeyaml/issues/issue377/ReferencesTest.java was then introduced, see commit [2]. I would be inclined to close this as wontfix. [0] https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion [1] https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack [2] https://bitbucket.org/asomov/snakeyaml/commits/04378d05777d21d114a9cdc24976ad49c8919222 I tend to agree with you Pedro. Closing and feel free to re-open. Hi Pedro, After this issue was closed the upstream has published a patch [0]. Please consider applying it to the following packages: - SUSE:SLE-12-SP3:Update:Products:Manager32:Update/snakeyaml 1.10 - SUSE:SLE-15-SP1:Update:Products:Manager40:Update/snakeyaml 1.10 - SUSE:SLE-15-SP2:Update:Products:Manager41:Update/snakeyaml 1.10 - SUSE:SLE-15-SP2:Update/snakeyaml 1.25 openSUSE:Factory/snakeyaml is already up-to-date. [0] https://bitbucket.org/asomov/snakeyaml/commits/da11ddbd91c1f8392ea932b37fa48110fa54ed8c *** Bug 1186088 has been marked as a duplicate of this bug. *** It's great to see upstream finally came up with a patch for this CVE. Note that fstrba is the bugowner in IBS and he has already submitted to SLE-15-SP2 here: https://build.suse.de/request/show/241249 Hi fstrba, could you also submit this patch to: - SUSE:SLE-12-SP3:Update:Products:Manager32:Update/snakeyaml 1.10 - SUSE:SLE-15-SP1:Update:Products:Manager40:Update/snakeyaml 1.10 - SUSE:SLE-15-SP2:Update:Products:Manager41:Update/snakeyaml 1.10 Thanks SUSE-SU-2021:1876-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src): snakeyaml-1.28-3.5.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): snakeyaml-1.28-3.5.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): snakeyaml-1.28-3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. openSUSE-SU-2021:0855-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: openSUSE Leap 15.2 (src): snakeyaml-1.28-lp152.2.3.1 SUSE-SU-2021:1979-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src): snakeyaml-1.28-12.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2021:1978-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (src): snakeyaml-1.28-12.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. openSUSE-SU-2021:1876-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: openSUSE Leap 15.3 (src): snakeyaml-1.28-3.5.1 fixed |