Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2017-18640GHSA-RVWF-54QP-4R6V

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 1.26
None on Exploit-DB, Metasploit or GitHub

Summary

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Timeline

  1. CVE published
  2. Record last updated
  3. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • n/a n/a

    Version range not reported

  • org.yaml:snakeyamlMaven

    fixed in 1.26

References 25

lists.fedoraproject.org

lists.apache.org