https://bugzilla.redhat.com/show_bug.cgi?id=1785376
Bug ID: 1785376 Summary: CVE-2017-18640 snakeyaml: the alias feature entity expansion during a load operation Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: decathorpe@gmail.com, hhorak@redhat.com, jaromir.capik@email.cz, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jorton@redhat.com, mizdebsk@redhat.com, mo@morsi.org, stewardship-sig@lists.fedoraproject.org Target Milestone: --- Classification: Other
The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Reference: https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-pr...