PT-2023-30338

CVE-2023-47163

·

Published

2023-11-13

·

Updated

2023-11-16

Description by

CVSS 4.0
8.7
High
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Remarshal versions prior to 0.17.1
Description The issue allows for the expansion of YAML alias nodes unlimitedly, making Remarshal susceptible to a Billion Laughs Attack. This can lead to a denial-of-service (DoS) condition when processing untrusted YAML files.
Recommendations For versions prior to 0.17.1, update to version 0.17.1 or later to resolve the issue. As a temporary workaround, consider avoiding the processing of untrusted YAML files until the update is applied.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Related identifiers
GHSA-GW7G-QR8W-3448
PYSEC-2023-236
Found an issue in the description? Have something to add? Feel free to write us 👾