CVE-2018-1051
Published: 25 January 2018
It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.
Notes
| Author | Note |
|---|---|
| msalvatore | Incomplete fix for CVE-2016-9606 not applied. That fix just disables the YamlProvider by default. There is no fix for this issue other than to mitigate it by requiring authentication and authorization on endpoints expecting YAML input. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
resteasy Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Not vulnerable
(3.6.2-2)
|
|
| focal |
Not vulnerable
(3.6.2-2)
|
|
| groovy |
Not vulnerable
(3.6.2-2)
|
|
| hirsute |
Not vulnerable
(3.6.2-2)
|
|
| impish |
Not vulnerable
(3.6.2-2)
|
|
| jammy |
Not vulnerable
(3.6.2-2)
|
|
| kinetic |
Not vulnerable
(3.6.2-2)
|
|
| lunar |
Not vulnerable
(3.6.2-2)
|
|
| mantic |
Not vulnerable
(3.6.2-2)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(3.1.4-1)
|
|
| xenial |
Needed
|
|
|
resteasy3.0 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Not vulnerable
(3.0.26-1)
|
|
| cosmic |
Ignored
(end of life)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Not vulnerable
(3.0.26-1)
|
|
| focal |
Not vulnerable
(3.0.26-1)
|
|
| groovy |
Not vulnerable
(3.0.26-1)
|
|
| hirsute |
Not vulnerable
(3.0.26-1)
|
|
| impish |
Not vulnerable
(3.0.26-1)
|
|
| jammy |
Not vulnerable
(3.0.26-1)
|
|
| kinetic |
Not vulnerable
(3.0.26-1)
|
|
| lunar |
Not vulnerable
(3.0.26-1)
|
|
| mantic |
Not vulnerable
(3.0.26-1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(3.0.26-1)
|
|
| xenial |
Does not exist
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |