Back
CVE-2017-18640
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
High7.5EPSS 26.7%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 26.7% · top 2.0% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
n/a
- affected n/a
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.yaml:snakeyamlGHSA-rvwf-54qp-4r6v (opens in a new tab)
References (59)
- FEDORA-2020-599514b47e (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2020-23012fafbc (opens in a new tab)vendor-advisoryx_transferred
- [pulsar-commits] 20200830 [GitHub] [pulsar] codelipenghui commented on issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-dev] 20200830 [jira] [Created] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20200830 [jira] [Updated] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20200830 [jira] [Created] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [pulsar-commits] 20200831 [GitHub] [pulsar] wolfstudy edited a comment on issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 (opens in a new tab)mailing-listx_transferred
- [pulsar-commits] 20200831 [GitHub] [pulsar] wolfstudy commented on issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20200831 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200907 [GitHub] [atlas] crazylab opened a new pull request #109: Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [cassandra-pr] 20200907 [GitHub] [cassandra] crazylab opened a new pull request #736: Upgrade to a snakeyaml version without CVE (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200907 [GitHub] [atlas] crazylab opened a new pull request #110: Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200907 [GitHub] [atlas] crazylab closed pull request #109: Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [pulsar-commits] 20200907 [GitHub] [pulsar] jiazhai closed issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20200909 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200914 [GitHub] [atlas] nixonrodrigues commented on pull request #110: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200914 [jira] [Created] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200914 [jira] [Updated] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-commits] 20200915 [atlas] branch master updated: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 (#110) (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200915 [GitHub] [atlas] nixonrodrigues merged pull request #110: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200915 [jira] [Commented] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [atlas-commits] 20200916 [atlas] 02/02: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 (#110) (opens in a new tab)mailing-listx_transferred
- [atlas-dev] 20200916 [jira] [Commented] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20200930 [jira] [Created] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20200930 [jira] [Updated] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20200930 [jira] [Comment Edited] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20200930 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201001 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201002 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201002 [jira] [Comment Edited] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201007 [jira] [Updated] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201007 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201009 [jira] [Comment Edited] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201009 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201009 [jira] [Updated] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [cassandra-commits] 20201009 [cassandra] branch trunk updated: Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20201026 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20201027 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20201028 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20201028 [jira] [Updated] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-commits] 20201028 [hadoop] branch trunk updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. (opens in a new tab)mailing-listx_transferred
- [hadoop-common-commits] 20201028 [hadoop] branch branch-3.3 updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. (opens in a new tab)mailing-listx_transferred
- [phoenix-dev] 20210419 [jira] [Created] (OMID-207) Upgrade to snakeyaml 1.26 due to CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [phoenix-dev] 20210419 [GitHub] [phoenix-omid] richardantal opened a new pull request #93: OMID-207 Upgrade to snakeyaml 1.26 due to CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_transferred
- https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion (opens in a new tab)x_transferred
- https://mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usages (opens in a new tab)x_transferred
- https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack (opens in a new tab)x_transferred
- https://lists.apache.org/thread.html/r4c682fb8cf69dd14162439656a6ebdf42ea6ad0e4edba95907ea3f14%40%3Ccommits.servicecomb.apache.org%3E (opens in a new tab)x_transferred
- https://lists.apache.org/thread.html/r900e020760c89f082df1c6e0d46320eba721e4e47bb9eb521e68cd95%40%3Ccommits.servicecomb.apache.org%3E (opens in a new tab)x_transferred
- [kafka-users] 20210617 vulnerabilities (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20211006 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-commits] 20211008 [hadoop] branch branch-3.2.3 updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20211008 [jira] [Updated] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- [hadoop-common-commits] 20211008 [hadoop] branch branch-3.2 updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. (opens in a new tab)mailing-listx_transferred
- [hadoop-common-issues] 20211008 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 (opens in a new tab)mailing-listx_transferred
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes (opens in a new tab)x_transferred
- https://bitbucket.org/snakeyaml/snakeyaml/issues/377 (opens in a new tab)x_transferred
- GLSA-202305-28 (opens in a new tab)vendor-advisoryx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-rvwf-54qp-4r6v (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-18640)Record last updated .