Bugzilla – Bug 1159488
VUL-0: CVE-2017-18640: snakeyaml: The Alias feature allows entity expansion during a load operation
Last modified: 2022-04-07 10:23:07 UTC
CVE-2017-18640 The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18640 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-18640.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18640 https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion https://mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usages
According to [0], upstream is not inclined to fix this and they point the user to be careful about the input, see [1]. This was addressed in the past and the test src/test/java/org/yaml/snakeyaml/issues/issue377/ReferencesTest.java was then introduced, see commit [2]. I would be inclined to close this as wontfix. [0] https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion [1] https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack [2] https://bitbucket.org/asomov/snakeyaml/commits/04378d05777d21d114a9cdc24976ad49c8919222
I tend to agree with you Pedro. Closing and feel free to re-open.
Hi Pedro, After this issue was closed the upstream has published a patch [0]. Please consider applying it to the following packages: - SUSE:SLE-12-SP3:Update:Products:Manager32:Update/snakeyaml 1.10 - SUSE:SLE-15-SP1:Update:Products:Manager40:Update/snakeyaml 1.10 - SUSE:SLE-15-SP2:Update:Products:Manager41:Update/snakeyaml 1.10 - SUSE:SLE-15-SP2:Update/snakeyaml 1.25 openSUSE:Factory/snakeyaml is already up-to-date. [0] https://bitbucket.org/asomov/snakeyaml/commits/da11ddbd91c1f8392ea932b37fa48110fa54ed8c
*** Bug 1186088 has been marked as a duplicate of this bug. ***
It's great to see upstream finally came up with a patch for this CVE. Note that fstrba is the bugowner in IBS and he has already submitted to SLE-15-SP2 here: https://build.suse.de/request/show/241249
Hi fstrba, could you also submit this patch to: - SUSE:SLE-12-SP3:Update:Products:Manager32:Update/snakeyaml 1.10 - SUSE:SLE-15-SP1:Update:Products:Manager40:Update/snakeyaml 1.10 - SUSE:SLE-15-SP2:Update:Products:Manager41:Update/snakeyaml 1.10 Thanks
SUSE-SU-2021:1876-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src): snakeyaml-1.28-3.5.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): snakeyaml-1.28-3.5.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): snakeyaml-1.28-3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:0855-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: openSUSE Leap 15.2 (src): snakeyaml-1.28-lp152.2.3.1
SUSE-SU-2021:1979-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src): snakeyaml-1.28-12.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1978-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (src): snakeyaml-1.28-12.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:1876-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1159488,1186088 CVE References: CVE-2017-18640 JIRA References: Sources used: openSUSE Leap 15.3 (src): snakeyaml-1.28-3.5.1
fixed