SnakeYAML Entity Expansion during load operation

高危 7.5CVE-2017-18640 · GHSA-rvwf-54qp-4r6v · Published 12/12/2019 · updated 17/06/2026

要点

CVE-2017-18640 是影响 org.yaml:snakeyaml, peoplesoft enterprise pt peopletools (oracle), quarkus (quarkus) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：26.7%，高于 98.0% 的漏洞。
修复：升级到 1.26 或更高版本。

Package	Affected versions	Patched versions
org.yaml:snakeyaml Maven	`< 1.26`	`1.26`
peoplesoft enterprise pt peopletools oracle	`= 8.56= 8.57= 8.58`	No fix yet
quarkus quarkus	`≤ 1.3.4`	No fix yet
snakeyaml snakeyaml_project	`< 1.26`	`1.26`

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

NVD description

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.