CVE-2017-18640 (High) detected in snakeyaml-1.23.jar
mend-bolt-for-github opened this issue · comments
CVE-2017-18640 - High Severity Vulnerability
Vulnerable Library - snakeyaml-1.23.jar
YAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /tmp/ws-scm/skester/build.gradle
Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar,/root/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.23/ec62d74fe50689c28c0ff5b35d3aebcaa8b5be68/snakeyaml-1.23.jar
Dependency Hierarchy:
- Skript-2.3.7.jar (Root Library)
- wagon-ftp-1.0-alpha-2.jar
- wagon-ftp-1.0-alpha-2.jar
- ❌ snakeyaml-1.23.jar (Vulnerable Library)
- wagon-ftp-1.0-alpha-2.jar
- wagon-ftp-1.0-alpha-2.jar
Found in HEAD commit: e31e0ef035972122f5b797c753e1761750961480
Vulnerability Details
The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Publish Date: 2019-12-12
URL: CVE-2017-18640
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with WhiteSource here