~ / search / GHSA-gw7g-qr8w-3448

GHSA-gw7g-qr8w-3448

Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack

Source: GitHub Advisory Database (reviewed) High CVE-2023-47163

Packages

EcosystemPackageAffectedFixed in
PyPI remarshal < 0.17.1 0.17.1

Details

As written in the advisory (Markdown source, shown as plain text).

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.

References

External links from the advisory. They lead to third-party sites.