PT-2023-21575 · Kaml · Kaml

Gdude2002 · Published 2023-03-20 · Updated 2023-03-24 · CVE-2023-28118

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions kaml versions prior to 0.53.0

Description The issue affects applications that use kaml to parse untrusted input containing anchors and aliases, potentially leading to excessive memory consumption and crashes. This is related to a class of vulnerability known as a "billion laughs attack", which is explained on Wikipedia. There are no known workarounds for this issue.

Recommendations For versions prior to 0.53.0, update to version 0.53.0 or later, which defaults to refusing to parse YAML documents containing anchors and aliases. As a temporary workaround, consider avoiding the use of anchors and aliases in YAML documents until the issue is resolved.

Exploit

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2023-28118

GHSA-C24F-2J3G-RG48

Affected Products

Kaml

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28118.json · Exploit
• https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a · Patch
• https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28118 · Security Note
• https://osv.dev/vulnerability/GHSA-c24f-2j3g-rg48 · Vendor Advisory
• https://github.com/charleskorn/kaml/releases/tag/0.53.0 · Note
• https://github.com/charleskorn/kaml · Note
• https://t.me/cibsecurity/60306 · Telegram Post