high7.5
CVE-2023-47163
Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack
Impact
Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | remarshal | < 0.17.1 | 0.17.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Remarshal Project | Remarshal | before 0.17.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/remarshal-project/remarshal/commit/fd6ac799a02f533c3fc243b49cdd6d21aa7ee494
- https://github.com/remarshal-project/remarshal/releases/tag/v0.17.1
- https://jvn.jp/en/jp/JVN86156389/
- https://github.com/advisories/GHSA-gw7g-qr8w-3448
- https://nvd.nist.gov/vuln/detail/CVE-2023-47163
- https://github.com/pypa/advisory-database/tree/main/vulns/remarshal/PYSEC-2023-236.yaml
- https://jvn.jp/en/jp/JVN86156389