PT-2019-5799 · Snakeyaml+8 · Snakeyaml+8

Published 2019-11-12 · Updated 2025-03-27 · CVE-2017-18640

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SnakeYAML versions prior to 1.26

Description The issue is related to errors in processing XML entities, which can lead to a denial of service when exploited by a remote attacker. The problem is associated with the Alias feature during a load operation, allowing entity expansion.

Recommendations For versions prior to 1.26, update to version 1.26 or later to resolve the issue. As a temporary workaround, consider disabling the Alias feature until a patch is available.

Exploit

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

ALSA-2020:4807

ALT-PU-2021-1895

BDU:2021-02625

CESA-2020_4807

CVE-2017-18640

GHSA-RVWF-54QP-4R6V

OPENSUSE-SU-2021:0855-1

OPENSUSE-SU-2021:1876-1

OPENSUSE-SU-2021_1876-1

OPENSUSE-SU-2024:11391-1

RHSA-2020:4807

RHSA-2020_4807

RLSA-2020:4807

SUSE-SU-2021:1876-1

SUSE-SU-2021:1978-1

SUSE-SU-2021:1979-1

SUSE-SU-2021_1876-1

USN-7368-1

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Red Hat

Rocky Linux

Snakeyaml

Suse

Ubuntu

References · 156

• 🔥 https://bitbucket.org/snakeyaml/snakeyaml/issues/377 · Exploit
• 🔥 https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-18640 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4807.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0855-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1979-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTVJC54XGX26UJVVYCXZ7D25X3R5T2G6 · Vendor Advisory
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://osv.dev/vulnerability/SUSE-SU-2021:1978-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PTVJC54XGX26UJVVYCXZ7D25X3R5T2G6 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1876-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18640 · Security Note
• https://osv.dev/vulnerability/RLSA-2020:4807 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:4807 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-18640 · Vendor Advisory