CVE-2017-18640: fedoraproject fedora XML Entity Expansion

CVSS: 7.5v3.1HighModified

AliasesSUSE-SU-2021:1876-1SUSE-SU-2021:1978-1SUSE-SU-2021:1979-1+188 more

Published 12-12-2019Last modified 05-08-2024

Vulnerability summary

CVE-2017-18640 is a high (CVSS 7.5) XML Entity Expansion vulnerability in fedoraproject fedora. EPSS estimates a 26.72% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

45/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

26.72%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Timeline

12-12-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

26.72%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 26.72% on 19-09-2026

19-09-202619-10-2026

EPSS score

26.72%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (bitbucket.org)
Maturity: unknown
referenceUnverified
Exploit Reference (bitbucket.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Affected systems

Chainguard87 products

eco-java-gradle-1.11All versions (No fix recorded)
eco-java-gradle-2.0All versions (No fix recorded)
eco-java-gradle-2.1All versions (No fix recorded)
eco-java-gradle-2.10All versions (No fix recorded)
eco-java-gradle-2.11All versions (No fix recorded)

eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)
eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-2.2All versions (No fix recorded)
eco-java-gradle-2.2.1All versions (No fix recorded)
eco-java-gradle-2.3All versions (No fix recorded)
eco-java-gradle-2.4All versions (No fix recorded)
eco-java-gradle-2.5All versions (No fix recorded)
eco-java-gradle-2.6All versions (No fix recorded)
eco-java-gradle-2.7All versions (No fix recorded)
eco-java-gradle-2.8All versions (No fix recorded)
eco-java-gradle-2.9All versions (No fix recorded)
eco-java-gradle-3.0All versions (No fix recorded)
eco-java-gradle-3.1All versions (No fix recorded)
eco-java-gradle-3.2All versions (No fix recorded)
eco-java-gradle-3.2.1All versions (No fix recorded)
eco-java-gradle-3.3All versions (No fix recorded)
eco-java-gradle-3.4All versions (No fix recorded)
eco-java-gradle-3.4.1All versions (No fix recorded)
eco-java-gradle-3.5All versions (No fix recorded)
eco-java-gradle-3.5.1All versions (No fix recorded)
eco-java-gradle-4.0All versions (No fix recorded)
eco-java-gradle-4.0.1All versions (No fix recorded)
eco-java-gradle-4.0.2All versions (No fix recorded)
eco-java-gradle-4.1All versions (No fix recorded)
eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
eco-java-gradle-6.3All versions (No fix recorded)
eco-java-gradle-6.4All versions (No fix recorded)
eco-java-gradle-6.4.1All versions (No fix recorded)
eco-java-gradle-6.5All versions (No fix recorded)
eco-java-gradle-6.5.1All versions (No fix recorded)
eco-java-gradle-6.6All versions (No fix recorded)
eco-java-gradle-6.6.1All versions (No fix recorded)
eco-java-gradle-6.7All versions (No fix recorded)
eco-java-gradle-6.7.1All versions (No fix recorded)
eco-java-gradle-6.8All versions (No fix recorded)
eco-java-gradle-6.8.1All versions (No fix recorded)
eco-java-gradle-6.8.2All versions (No fix recorded)
eco-java-gradle-6.8.3All versions (No fix recorded)
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)

Show all 87

Suse5 products

snakeyaml&distro=SUSE Linux Enterprise Module for Development Tools 15 SP2< 1.28-3.5.1
snakeyaml&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 1.28-3.5.1
snakeyaml&distro=SUSE Manager Server Module 4.0< 1.28-12.3.1
snakeyaml&distro=SUSE Manager Server Module 4.1< 1.28-12.3.1
snakeyaml&distro=SUSE Manager Server Module 4.2< 1.28-3.5.1

Opensuse3 products

snakeyaml&distro=openSUSE Leap 15.2< 1.28-lp152.2.3.1
snakeyaml&distro=openSUSE Leap 15.3< 1.28-3.5.1
snakeyaml&distro=openSUSE Tumbleweed< 1.28-2.2

Debian1 product

snakeyaml< 1.25+ds-3

Fedoraproject1 product

fedoraEOL31 | 32

Oracle1 product

peoplesoft_enterprise_pt_peopletools8.56 | 8.57 | 8.58

Org.yaml1 product

snakeyaml< 1.26

Quarkus1 product

quarkus≤ 1.3.4

Redhat1 product

prometheus-jmx-exporter< 0:0.12.0-6.el8

Snakeyaml_project1 product

snakeyaml< 1.26

Ubuntu1 product

snakeyaml< 1.12-2ubuntu0.14.04.1~esm2 | < 1.12-2ubuntu0.16.04.1~esm2 | < 1.23-1+deb10u1ubuntu0.1~esm1 | < 1.25+ds-2ubuntu0.1+esm1

11 vendors · 103 products

References

133 links

lists.fedoraproject.org/archives/…Vendor AdvisoryWEB
lists.fedoraproject.org/archives/…Vendor AdvisoryWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB

Show all 100 references

lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
www.oracle.com/security-alerts/cpuApr2021.htmlPatchThird Party AdvisoryFIXWEB
bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billionExploitIssue TrackingPatchThird Party AdvisoryREPORTFIXWEB
mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usagesThird Party AdvisoryREPORTAdvisoryWEB
bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attackThird Party AdvisoryAdvisoryWEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
lists.apache.org/thread.html/…Mailing ListWEB
bitbucket.org/snakeyaml/snakeyaml/wiki/ChangesRelease NotesThird Party AdvisoryAdvisoryWEB
bitbucket.org/snakeyaml/snakeyaml/issues/377ExploitIssue TrackingThird Party AdvisoryREPORTWEB
security.gentoo.org/glsa/202305-28Vendor AdvisoryAdvisoryWEB
www.suse.com/support/update/announcement/2021/suse-su-20211876-1/Advisory
bugzilla.suse.com/1159488REPORT
bugzilla.suse.com/1186088REPORT
www.suse.com/security/cve/CVE-2017-18640WEB
www.suse.com/support/update/announcement/2021/suse-su-20211978-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20211979-1/Advisory
access.redhat.com/errata/RHSA-2020:4807Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1785376REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4807.jsonAdvisory
access.redhat.com/security/cve/CVE-2017-18640REPORT
www.cve.org/CVERecord?id=CVE-2017-18640AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2017-18640AdvisoryOval
ubuntu.com/security/CVE-2017-18640REPORT
ubuntu.com/security/notices/USN-7368-1Advisory
security-tracker.debian.org/tracker/CVE-2017-18640Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
bitbucket.org/asomov/snakeyamlPACKAGE
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB

Showing 100 of 133. Use Open JSON for the complete list.

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities