OPENSUSE-SU-2021:0855-1 Security update for snakeyaml

This update for snakeyaml fixes the following issues: - Upgrade to 1.28 - CVE-2017-18640: The Alias feature allows entity expansion during a load operation bsc1159488, bsc1186088 This update was imported from the SUSE:SLE-15-SP2:Update update project...

SUSE-SU-2021:1876-1 Security update for snakeyaml

This update for snakeyaml fixes the following issues: - Upgrade to 1.28 - CVE-2017-18640: The Alias feature allows entity expansion during a load operation bsc1159488, bsc1186088...

GHSA-RVWF-54QP-4R6V SnakeYAML Entity Expansion during load operation

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

SnakeYAML Entity Expansion during load operation

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

The vulnerability of the SnakeYAML syntax analyzer allows for errors in processing XML entities, enabling attackers to trigger a service failure.

The vulnerability of the SnakeYAML syntax analyzer is related to errors in processing XML entities. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Kubernetes: Loading YAML in Java client can lead to command execution

The io.kubernetes.client.util.Yaml file in the Kubernetes client library for Java uses a popular library SnakeYAML to serialize and deserialize YAML. The library has a feature which makes it possible to initiate instances of Java classes by using a YAML tag like !!some.Class "argument1" . More in...

JFrog < 6.23.0 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 6.23.0. It is, therefore, affected by multiple vulnerabilities: - The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation. CVE-2017-18640 - The file...

New Relic: Untrusted deserialization issue when loading newrelic.yml file in Java agent leads to code execution on host

Hi team, The New Relic Java agent is using SnakeYAML for deserialization of the newrelic.yml config file. SnakeYAML has a 'feature' which can lead to code execution, this is documented here. With the !!com.some.Class "arg1", "arg2" notation it's possible to call Java code during the deserializati...

Security Bulletin: Vulnerability has been identified in SnakeYAML used by IBM Dependency Based Build

Summary A vulnerability has been identified in SnakeYAML used by IBM Dependency Based BUild. SnakeYAML is used to load local YAML property files and is unlikely to cause a DoS incident described in the Vulnerability Details below. However, IBM recommends upgrading to version 1.1.0 or later...

CentOS 8 : prometheus-jmx-exporter (CESA-2020:4807)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:4807 advisory. - snakeyaml: Billion laughs attack via alias feature CVE-2017-18640 Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2021-21249

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default when not using SafeConstructor allows the...

CVE-2021-21249

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default when not using SafeConstructor allows the...

Remote code execution

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default when not using SafeConstructor allows the...

CVE-2021-21249 Post-Auth Unsafe Yaml deserialization

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default when not using SafeConstructor allows the...

CVE-2021-21249

CVE-2021-21249 affects OneDev prior to 4.0.3, where YAML parsing with SnakeYaml could deserialize arbitrary classes, enabling post-auth remote code execution. The root cause is unsafe deserialization when not using SafeConstructor, allowing crafted YAML to instantiate user-controlled classes (e.g...

prometheus-jmx-exporter security update

0.12.0-6 - Fix CVE-2017-18640 by using updated snakeyaml...

snakeyaml: Billion laughs attack via alias feature

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564...

Moderate: Red Hat Security Advisory: prometheus-jmx-exporter security update

An update for prometheus-jmx-exporter is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 8 : prometheus-jmx-exporter (RHSA-2020:4807)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:4807 advisory. Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security...

ALSA-2020:4807 Moderate: prometheus-jmx-exporter security update

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security Fixes: snakeyaml: Billion laughs attack via alias feature CVE-2017-18640 For more details about the security issues, including the impact, a CVSS score...