CVE-2023-47163: Remarshal YAML Parsing Denial-of-Service Vulnerability
Summary
CVE-2023-47163: Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Affects remarshal across 2 version ranges.
< 0.17.1
< fd6ac799a02f533c3fc243b49cdd6d21aa7ee494
Fixed in fd6ac799a02f533c3fc243b49cdd6d21aa7ee494. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Remarshal is an open-source Python package available on PyPI that provides functionality for converting between various data serialization formats, including YAML. It is commonly used for transforming YAML files into other formats or vice versa. The package is vulnerable to a Denial-of-Service (DoS) attack due to the way it handles YAML alias nodes. When processing untrusted YAML files, an attacker can exploit this vulnerability to cause a DoS condition, potentially leading to service disruption.
Vulnerability Detail
The vulnerability, known as the Billion Laughs Attack, arises from the unlimited expansion of YAML alias nodes in Remarshal prior to version 0.17.1. By crafting a malicious YAML file with a large number of alias nodes, an attacker can overwhelm the parsing process, consuming excessive memory and CPU resources. This can result in the targeted application becoming unresponsive or crashing, leading to a DoS condition. It is important to note that this vulnerability only affects versions of Remarshal prior to 0.17.1.
How To Fix
Minimum fixed version
fd6ac799a02f533c3fc243b49cdd6d21aa7ee494
This is the first release that contains the fix.
pip install --upgrade "remarshal==fd6ac799a02f533c3fc243b49cdd6d21aa7ee494"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Remarshal is not immediately feasible, a temporary workaround is to avoid processing untrusted YAML files using the vulnerable versions of Remarshal. Implementing input validation and sanitization can help mitigate the risk of encountering malicious YAML files. Additionally, considering alternative YAML parsing libraries that are not affected by the Billion Laughs Attack can provide a temporary solution.
Conclusion
In conclusion, the Remarshal package prior to version 0.17.1 is vulnerable to a Denial-of-Service (DoS) attack known as the Billion Laughs Attack. By updating to version 0.17.1 or later, users can mitigate this vulnerability. It is important to promptly address this issue to prevent potential service disruptions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for remarshal →
FAQ
The vulnerability in Remarshal can lead to a Denial-of-Service (DoS) condition, potentially causing service disruption. An attacker can exploit this vulnerability by providing a specially crafted YAML file, overwhelming the parsing process and consuming excessive resources.
Versions of Remarshal prior to 0.17.1 are vulnerable to the Billion Laughs Attack. It is recommended to update to version 0.17.1 or later to mitigate this vulnerability.
Yes, this vulnerability can be exploited remotely. An attacker can provide a malicious YAML file to the targeted application, triggering the DoS condition.
Updating Remarshal to version 0.17.1 or later is the recommended mitigation for this vulnerability. Implementing input validation and sanitization can also help reduce the risk of encountering malicious YAML files.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
