What is GHSA-c24f-2j3g-rg48?

GHSA-c24f-2j3g-rg48 is a security advisory published by GitHub Security Advisories with High severity. kaml has potential denial of service while parsing input with anchors and aliases

Which CVE IDs does GHSA-c24f-2j3g-rg48 cover?

GHSA-c24f-2j3g-rg48 covers the following CVE IDs: CVE-2023-28118. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c24f-2j3g-rg48?

GHSA-c24f-2j3g-rg48 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-c24f-2j3g-rg48?

GHSA-c24f-2j3g-rg48 affects 1 product, including: maven/com.charleskorn.kaml:kaml:\u003c 0.53.0.

GHSA-c24f-2j3g-rg48HighCVSS 7.5

kaml has potential denial of service while parsing input with anchors and aliases

Vendor

GitHub Security Advisories

Published

March 20, 2023

Last Modified

March 20, 2023

🔗 CVE IDs covered (1)

CVE-2023-28118 →

📋 Description

Impact

Applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash.

Patches

Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases.

Workarounds

None.

References

Wikipedia has an explanation of this class of vulnerability: billion laughs attack

Acknowledgements

Thank you to @gdude2002 for reporting this issue.

🎯 Affected products1

maven/com.charleskorn.kaml:kaml:< 0.53.0

🔗 References (5)

https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48
https://nvd.nist.gov/vuln/detail/CVE-2023-28118
https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a
https://github.com/charleskorn/kaml/releases/tag/0.53.0
https://github.com/advisories/GHSA-c24f-2j3g-rg48