Code injection

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

CVE-2020-1947

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

CVE-2020-1947

CVE-2020-1947 affects Apache ShardingSphere (incubator) 4.0.0-RC3 and 4.0.0. The web console uses SnakeYAML to parse YAML for datasource config; untrusted YAML can be unmarshaled to a Java type via YAML tags, enabling remote code execution (RCE). Impact described as potential arbitrary code execu...

Hyperledger: RCE vulnerability in Hyperledger Fabric SDK for Java

Hyperledger Fabric SDK for Java version 2.0.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. In the following source code files and corresponding line number, an arbitrary file gets parsed by...

Denial Of Service (DoS)

snakeyaml is vulnerable to denial of service. The library allows an attacker to crash the application through an entity expansion attack, also known as billion laughs attack, by providing a malicious YAML file to be parsed...

SnakeYAML Denial of Service Vulnerability

SnakeYAML is a Java-based YAML parser . A security vulnerability exists in the Alias feature in SnakeYAML version 1.18. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

CVE-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

CVE-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

Design/Logic Flaw

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

UBUNTU-CVE-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

CVE-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

CVE-2017-18640

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

CVE-2017-18640

CVE-2017-18640 affects SnakeYAML; the vulnerability arises from entity expansion (Billion Laughs style) during load, allowing abuse of the alias feature. Affected versions are before 1.26 (e.g., SnakeYAML 1.25.x onward) with public mentions in multiple advisories showing a fix in 1.26. Fedora/Alm...

Remote Code Execution (RCE)

RESTEasy is vulnerable to remote code execution. SnakeYAML unmarshalling is exploitable for code execution. As RESTeasy uses SnakeYAML and enables the yaml provider by default, under certain conditions, RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of...

org.apache.camel:camel-snakeyaml-starter (>=2.18.0 <=2.18.1) potentially affected by CVE-2017-3159 via org.apache.camel:camel-snakeyaml (>=2.18.0 <=2.18.1)

org.apache.camel:camel-snakeyaml MAVEN version =2.18.0, =2.18.0, =2.18.1 Source cves: CVE-2017-3159 Source advisory: OSV:GHSA-HVPR-9CR6-Q5V7...

GHSA-HVPR-9CR6-Q5V7 Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization. De-serializing untrusted data can lead to security flaws...

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization. De-serializing untrusted data can lead to security flaws...

Apache Brooklyn Remote Code Execution Vulnerability

Apache Brooklyn is the United States Apache Apache Software Foundation's set of frameworks for deploying and managing distributed applications by monitoring and managing applications. A security vulnerability exists in SnakeYAML in versions of Apache Brooklyn prior to 0.10.0. An attacker could...

Default configuration

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...