Описание
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| snakeyaml | fixed | 1.25+ds-3 | package | |
| snakeyaml | no-dsa | buster | package | |
| snakeyaml | no-dsa | stretch | package | |
| snakeyaml | no-dsa | jessie | package |
Примечания
https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion
Patch to introduce a configuration option to restrict aliases for
collections:
https://bitbucket.org/asomov/snakeyaml/commits/da11ddbd91c1f8392ea932b37fa48110fa54ed8c
EPSS
Связанные уязвимости
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
EPSS