Описание
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat A-MQ Online | prometheus-jmx-exporter | Not affected | ||
| Red Hat Enterprise Linux 7 | snakeyaml | Will not fix | ||
| Red Hat Single Sign-On 7 | snakeyaml | Not affected | ||
| Red Hat Software Collections | rh-java-common-snakeyaml | Out of support scope | ||
| Red Hat Software Collections | rh-maven35-snakeyaml | Will not fix | ||
| Red Hat AMQ Streams 1.8.0 | prometheus-jmx-exporter | Fixed | RHSA-2021:3225 | 19.08.2021 |
| Red Hat build of Quarkus 1.3.4 | snakeyaml | Fixed | RHSA-2020:2603 | 17.06.2020 |
| Red Hat Enterprise Linux 8 | prometheus-jmx-exporter | Fixed | RHSA-2020:4807 | 04.11.2020 |
| Red Hat Fuse 7.9 | prometheus-jmx-exporter | Fixed | RHSA-2021:3140 | 11.08.2021 |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-776->CWE-122
https://bugzilla.redhat.com/show_bug.cgi?id=1785376snakeyaml: Billion laughs attack via alias feature
EPSS
Процентиль: 84%
0.02166
Низкий
7.6 High
CVSS3
Связанные уязвимости
CVSS3: 7.5
ubuntu
больше 6 лет назад
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
CVSS3: 7.5
nvd
больше 6 лет назад
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
CVSS3: 7.5
msrc
6 месяцев назад
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
CVSS3: 7.5
debian
больше 6 лет назад
The Alias feature in SnakeYAML before 1.26 allows entity expansion dur ...
EPSS
Процентиль: 84%
0.02166
Низкий
7.6 High
CVSS3