GitHub Advisoryadvisory · Maven

GHSA-m2fv-3rqm-g7p5 Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider

HIGH Published 2022-05-13 Modified 2022-11-01 Official page ↗
Aliases
CVE-2018-1051
Ecosystem
Maven
Packages
org.jboss.resteasy:resteasy-yaml-provider
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-11-01

Affected packages

• Maven org.jboss.resteasy:resteasy-yaml-provider: < 3.0.26.Final → fixed in 3.0.26.Final • Maven org.jboss.resteasy:resteasy-yaml-provider: >= 3.1.0, < 3.6.0.Final → fixed in 3.6.0.Final

Description

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider. Mitigation: If the YamlProvider is enabled it's recommended to add authentication, and authorization to the endpoint expecting Yaml content to prevent exploitation of this vulnerability.

Related

Alias · CVE (1)

  • CVE-2018-1051 It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References