GHSA-jm7r-4pg6-gf26

Esoteric YamlBeans Unsafe Deserialization vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-24621

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.esotericsoftware.yamlbeans:yamlbeans	<= 1.15	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-24621 advisory
https://contrastsecurity.com web
https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md web
https://github.com/EsotericSoftware web
https://github.com/EsotericSoftware/yamlbeans package