CVE-2023-47163: Remarshal YAML Expansion Denial-of-Service Vulnerability
Summary
CVE-2023-47163: Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Affects remarshal versions < 0.17.1. Fixed in 0.17.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Remarshal is a Python package available on PyPI that provides tools for converting between different data serialization formats, including YAML. It is commonly used for data transformation and manipulation tasks. However, prior to version 0.17.1, Remarshal is vulnerable to a YAML expansion denial-of-service attack, also known as the Billion Laughs Attack. This attack can be triggered by processing untrusted YAML files, leading to a potential denial-of-service condition.
Vulnerability Detail
The vulnerability in Remarshal arises from its unlimited expansion of YAML alias nodes. By exploiting this behavior, an attacker can craft a malicious YAML file that contains a large number of alias nodes, causing Remarshal to consume excessive memory and CPU resources during parsing. This can result in a denial-of-service condition, where the affected system becomes unresponsive or crashes. The impact of this vulnerability can be severe, especially if Remarshal is used in critical systems or processes that handle untrusted YAML data.
How To Fix
Minimum fixed version
0.17.1
This is the first release that contains the fix.
pip install --upgrade "remarshal==0.17.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Remarshal prior to version 0.17.1 is vulnerable to a YAML expansion denial-of-service attack, which can be triggered by processing malicious YAML files. To mitigate this vulnerability, it is crucial to upgrade to Remarshal version 0.17.1 or later. This update includes a fix that limits the expansion of YAML alias nodes, preventing the excessive resource consumption caused by the Billion Laughs Attack. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for remarshal →
FAQ
The Billion Laughs Attack is a type of denial-of-service attack that exploits the unlimited expansion of alias nodes in YAML parsing. By crafting a YAML file with a large number of alias nodes, an attacker can cause the parsing process to consume excessive memory and CPU resources, leading to a denial-of-service condition.
The vulnerability in Remarshal can result in a denial-of-service condition, where the affected system becomes unresponsive or crashes. This can disrupt critical processes or services that rely on Remarshal for parsing YAML data.
You can use the Vulert Playground at Vulert Scanner to check if your Remarshal installation is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities, including CVE-2023-47163.
At the moment, there are no known workarounds for this vulnerability. It is recommended to upgrade to Remarshal version 0.17.1 or later to mitigate the risk.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is still important to apply the recommended fix to ensure the security and stability of your Remarshal installation.
