Опубликовано: 13 нояб. 2023
Источник: github
Github: Прошло ревью
CVSS4: 8.7
CVSS3: 7.5
Описание
Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack
Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2023-47163
- https://github.com/remarshal-project/remarshal/commit/fd6ac799a02f533c3fc243b49cdd6d21aa7ee494
- https://github.com/pypa/advisory-database/tree/main/vulns/remarshal/PYSEC-2023-236.yaml
- https://github.com/remarshal-project/remarshal/releases/tag/v0.17.1
- https://jvn.jp/en/jp/JVN86156389
Пакеты
Наименование
remarshal
pip
Затронутые версииВерсия исправления
< 0.17.1
0.17.1
Связанные уязвимости
CVSS3: 7.5
nvd
около 2 лет назад
Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.