← All advisories

High severityNVD Advisory· Published Dec 12, 2019· Updated Aug 5, 2024

CVE-2017-18640

CVE-2017-18640

Description

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.yaml:snakeyamlMaven	< 1.26	1.26

Affected products

11

SnakeYAML/SnakeYAMLdescription
ghsa-coords10 versions
pkg:maven/org.yaml/snakeyaml pkg:rpm/almalinux/prometheus-jmx-exporter pkg:rpm/opensuse/snakeyaml&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/snakeyaml&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/snakeyaml&distro=openSUSE%20Tumbleweed pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2 pkg:rpm/suse/snakeyaml&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3 pkg:rpm/suse/snakeyaml&distro=SUSE%20Manager%20Server%20Module%204.0 pkg:rpm/suse/snakeyaml&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/snakeyaml&distro=SUSE%20Manager%20Server%20Module%204.2
< 1.26+ 9 more
- (no CPE)range: < 1.26
- (no CPE)range: < 0.12.0-6.el8
- (no CPE)range: < 1.28-lp152.2.3.1
- (no CPE)range: < 1.28-3.5.1
- (no CPE)range: < 1.28-2.2
- (no CPE)range: < 1.28-3.5.1
- (no CPE)range: < 1.28-3.5.1
- (no CPE)range: < 1.28-12.3.1
- (no CPE)range: < 1.28-12.3.1
- (no CPE)range: < 1.28-3.5.1

Patches

Vulnerability mechanics

References

112

News mentions

0

No linked articles in our index yet.