PT-2023-21575 · Kaml · Kaml

Gdude2002 · Publicado 2023-03-20 · Atualizado 2023-03-24 · CVE-2023-28118

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions kaml versions prior to 0.53.0

Description The issue affects applications that use kaml to parse untrusted input containing anchors and aliases, potentially leading to excessive memory consumption and crashes. This is related to a class of vulnerability known as a "billion laughs attack", which is explained on Wikipedia. There are no known workarounds for this issue.

Recommendations For versions prior to 0.53.0, update to version 0.53.0 or later, which defaults to refusing to parse YAML documents containing anchors and aliases. As a temporary workaround, consider avoiding the use of anchors and aliases in YAML documents until the issue is resolved.

Exploit

Correção

XML Entity Expansion

Enumeração de Fraquezas

CWE-776

Identificadores relacionados

CVE-2023-28118

GHSA-C24F-2J3G-RG48

Produtos afetados

Kaml

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28118.json · Exploit
• https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a · Correção
• https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48 · Aviso do Fabricante
• https://github.com/charleskorn/kaml/releases/tag/0.53.0 · Nota
• https://github.com/charleskorn/kaml · Nota
• https://osv.dev/vulnerability/CVE-2023-28118 · Aviso do Fabricante
• https://t.me/cibsecurity/60306 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28118 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c24f-2j3g-rg48 · Aviso do Fabricante