PT-2019-5799 · Snakeyaml+8 · Snakeyaml+8
Publicado
2019-11-12
·
Atualizado
2025-03-27
·
CVE-2017-18640
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
SnakeYAML versions prior to 1.26
Description
The issue is related to errors in processing XML entities, which can lead to a denial of service when exploited by a remote attacker. The problem is associated with the Alias feature during a load operation, allowing entity expansion.
Recommendations
For versions prior to 1.26, update to version 1.26 or later to resolve the issue.
As a temporary workaround, consider disabling the Alias feature until a patch is available.
Exploit
Correção
XML Entity Expansion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Linuxmint
Red Hat
Rocky Linux
Snakeyaml
Suse
Ubuntu