Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ndzdnLXFyOHctMzQ0OM4AA3Dw

Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.

Permalink: https://github.com/advisories/GHSA-gw7g-qr8w-3448
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ndzdnLXFyOHctMzQ0OM4AA3Dw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 month ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-gw7g-qr8w-3448, CVE-2023-47163
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-47163
• https://github.com/remarshal-project/remarshal/commit/fd6ac799a02f533c3fc243b49cdd6d21aa7ee494
• https://github.com/remarshal-project/remarshal/releases/tag/v0.17.1
• https://github.com/pypa/advisory-database/tree/main/vulns/remarshal/PYSEC-2023-236.yaml
• https://jvn.jp/en/jp/JVN86156389
• https://github.com/advisories/GHSA-gw7g-qr8w-3448

Repository: https://github.com/remarshal-project/remarshal
Blast Radius: 16.4

Affected Packages