CVE-2017-18640: SnakeYAML Entity Expansion during load operation
Summary
CVE-2017-18640: SnakeYAML Entity Expansion during load operation. Affects org.yaml:snakeyaml versions < 1.26. Fixed in 1.26. How to fix ↓
Also tracked for
- snakeyaml · Debian:11
The same CVE-2017-18640 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SnakeYAML is a YAML parser and emitter for the Java programming language. It provides a way to represent YAML documents in Java objects and vice versa. The package 'org.yaml:snakeyaml' is a popular Maven package that includes the SnakeYAML library. SnakeYAML is vulnerable to entity expansion during a load operation, which is a related issue to CVE-2003-1564. This vulnerability allows an attacker to perform entity expansion attacks, potentially leading to denial of service or other malicious activities.
Vulnerability Detail
The vulnerability in SnakeYAML allows for entity expansion during the load operation. This means that an attacker can craft a specially crafted YAML document that contains entities, which will be expanded when the document is loaded by SnakeYAML. This can lead to various security issues, such as denial of service attacks, excessive memory consumption, or even remote code execution if the expanded entities contain executable code. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.26
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of SnakeYAML as soon as possible.
Conclusion
The SnakeYAML library, specifically versions prior to 1.26, is vulnerable to entity expansion during the load operation. This can lead to various security issues, including denial of service and remote code execution. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of SnakeYAML, such as version 1.26 or higher. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.yaml:snakeyaml →
FAQ
SnakeYAML is a YAML parser and emitter for the Java programming language. It allows developers to work with YAML documents in their Java applications.
Entity expansion is a technique where entities in an XML or YAML document are expanded to their actual values during parsing. In the case of this vulnerability, entity expansion can lead to security issues.
CVE-2017-18640 is the identifier for the vulnerability in SnakeYAML that allows entity expansion during the load operation.
The potential consequences of this vulnerability include denial of service attacks, excessive memory consumption, and even remote code execution if the expanded entities contain executable code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for org.yaml:snakeyaml.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.